Loading story…
Two separate Windows authentication weaknesses were highlighted as enabling high-impact Active Directory compromise via relay-style attacks. One issue, CVE-2025-33073, affects Windows SMB client authentication and enables NTLM reflection: attackers can coerce lsass.exe (running as SYSTEM) to authenticate to attacker-controlled infrastructure using techniques such as PetitPotam, DFSCoerce, and Printerbug, then relay/reflect that authentication to gain SYSTEM-level access and potentially full domain compromise. Reporting emphasized that despite a June 2025 patch, the condition remains widely present in enterprise environments due to incomplete patch adoption, and exploitation can be enabled with relatively low prerequisites such as the ability to register a malicious AD DNS record (often permitted to Authenticated Users by default) or to perform local DNS poisoning.
A second technique described a Kerberos relay vector that abuses how Windows clients process DNS CNAME responses when building the SPN for TGS requests, allowing an on-path attacker (e.g., via ARP poisoning or DHCPv6/mitm6) to redirect victims to attacker-controlled services and obtain service tickets usable for relays and lateral movement. The write-up claims default configurations across Windows 10/11 and Windows Server 2022/2025 are susceptible, with potential impact including cross-protocol relays (e.g., HTTP→SMB/LDAP) and paths to RCE in some environments (e.g., via ADCS web enrollment scenarios). A separate Metasploit weekly wrap-up noted new and updated offensive modules (including AD privilege-escalation content), but it did not specifically tie to either of the two relay issues above.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A public proof-of-concept was released for CVE-2026-24294, an NTLM reflection bypass flaw affecting Windows Server 2025 that can yield SYSTEM-level access by relaying coerced NTLM authentication via SMB on a non-standard TCP port. The issue was described as bypassing Microsoft's earlier mitigation for CVE-2025-33073 and was demonstrated with modified coercion tooling and Impacket-based relay techniques.
A public write-up described how many enterprises remained unpatched months after the June 2025 fix for CVE-2025-33073, leaving systems exposed to NTLM reflection, coercion, and cross-protocol relay attacks affecting services such as LDAPS, ADCS, MSSQL, and WinRM.
Researchers disclosed technical details for a Kerberos relay attack that abuses malicious DNS CNAME responses during TGS requests, and released a modified mitm6 proof-of-concept with CNAME poisoning support. The attack was reported to work against default Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 configurations when anti-relay controls are absent.
Microsoft shipped January 2026 patches for CVE-2026-20929, adding Channel Binding Token support for HTTP.sys to mitigate part of the Kerberos relay attack chain. The underlying DNS CNAME coercion behavior was reported to remain for other protocols.
Researchers reported a Windows Kerberos weakness involving DNS CNAME-based service principal name manipulation to Microsoft. The disclosure reportedly occurred in October 2025.
Microsoft released June 2025 Windows updates for CVE-2025-33073, an SMB client vulnerability enabling NTLM reflection and relay attacks that can lead to privilege escalation and potential Active Directory compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security research teams reported **DNS-related abuse paths** that can be weaponized for denial-of-service and authentication relay. Unit 42 described how Azure *Private Endpoint/Private Link* DNS behavior can be leveraged—accidentally or maliciously—to disrupt access to Azure resources by effectively “over-privatizing” name resolution, creating a DoS condition for services such as **Storage Accounts, Key Vault, Cosmos DB, Azure Container Registry, Function Apps, and OpenAI accounts**. Their assessment suggested the exposure is not rare in the wild (they observed **5%+ of Azure storage accounts** in configurations susceptible to this DoS pattern) and noted Microsoft guidance around *internet fallback* as a partial mitigation, alongside recommendations to scan environments for susceptible configurations. Separately, Cymulate detailed a **Kerberos authentication relay technique via DNS CNAME abuse** in Windows/Active Directory environments: an on-path attacker can influence DNS CNAME resolution so Windows clients request Kerberos service tickets for attacker-chosen **SPNs**, enabling relays to services like **SMB/HTTP** when signing or **Channel Binding Tokens (CBT)** are not enforced. Cymulate stated Microsoft acknowledged the behavior and responded by improving target-service resilience, including **backported CBT support for HTTP.sys** in supported Windows Server versions (released in a January patch cycle). A third report from Positive Technologies analyzed an **RCE path in Windows Telephony Service (TAPI)** via arbitrary file write from a low-privileged client, which is a distinct Windows local/service exploitation topic and not part of the DNS/Kerberos abuse story.
Jun 29, 2026
Researchers and defenders warned that **Active Directory Certificate Services (AD CS)** can be abused to take over Windows domains through a combination of certificate misconfigurations and NTLM relay paths. SpecterOps documented multiple escalation techniques in its **Certified Pre-Owned** research, including vulnerable certificate templates, arbitrary Subject Alternative Name abuse, weak access controls, and relay attacks against AD CS web enrollment endpoints. The findings showed that attackers can obtain certificates usable for **PKINIT** or **Schannel** authentication, enabling privilege escalation, persistence that survives password resets, and in some cases creation of forged **"golden certificates"** if a CA private key is stolen. The risk became more urgent as the **PetitPotam** attack chain demonstrated how coercing NTLM authentication from a domain controller and relaying it to AD CS could lead to complete domain compromise. SANS highlighted the issue as a path to **domain admin**, while Microsoft published advisory **`ADV210003`** with mitigations rather than a security patch, recommending steps such as enabling **Extended Protection for Authentication**, requiring **HTTPS** on certificate enrollment endpoints, and reducing or disabling **NTLM** where possible. The combined disclosures showed that widely deployed AD CS environments could become a direct route to full Active Directory takeover if left misconfigured.
Jun 29, 2026
Microsoft disclosed multiple **privilege escalation** vulnerabilities in core enterprise products, including **Active Directory Domain Services** and **SQL Server**, with public reporting highlighting network-reachable attack paths that require only authenticated or otherwise authorized access. **CVE-2026-25177** affects AD DS and was described as an elevation-of-privilege issue tied to improper restriction of file and resource names, enabling abuse of crafted Unicode characters to create duplicate `SPN` or `UPN` values. Reporting indicates this can interfere with Kerberos ticket handling, potentially causing denial of service, triggering fallback to **NTLM** where enabled, and ultimately enabling escalation to **SYSTEM**-level control in affected environments. Microsoft also disclosed **CVE-2026-21262** in **SQL Server**, an **Important**-rated flaw with a **CVSS 8.8** score that allows an authenticated attacker to elevate privileges to `sysadmin`, giving full control over the database instance. Public reporting said Microsoft assessed exploitation as **less likely** and had not observed active in-the-wild abuse at disclosure time, but noted the issue was publicly disclosed, increasing the risk of follow-on exploit development. Other referenced items about **ADCS ESC1**, **Cisco SD-WAN Manager**, and **n8n** concern separate products and unrelated vulnerabilities, while the standalone MSRC entry does not provide enough detail in the supplied content to confirm it is part of the same specific event.
Jun 29, 2026