KerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade. Patched March 2026.
CVE-2026-25177 is the Active Directory SPN uniqueness bypass Semperis and Shai Laron named KerberLoss. AD did not treat invisible-Unicode look-alikes as collisions, so an attacker who can write an SPN registers a twin of HTTP/app.contoso.com, intercepts Kerberos traffic, and can downgrade the client to NTLM. CVSS 8.8. Microsoft patched it in March 2026.
This sits next to the 2025 Ghost SPN / SMB reflection work. SPNs are identity, not inventory trivia. We filed the brief under Kerberos / Active Directory with a concrete hunt: new SPNs that contain non-ASCII characters. There is almost never a business reason.
Why it matters
SPN uniqueness is the only thing standing between "I can write a servicePrincipalName" and "I am the app." If your delegation graph or DNS self-registration is messy, this CVE is how that mess becomes a ticket.
If you have not confirmed the March 2026 AD updates on every DC, do that, then restrict validated write to servicePrincipalName. The KerberLoss brief has the detection notes.
Source: NVD: CVE-2026-25177
Related on Start with Identity
- BlogResetNightmare: a low-priv UPN write can reset a Domain Admin via Kerberos kpasswd
CVE-2026-27912 lets a user who can write their own UPN aim a Kerberos change-password at a Domain Admin. Microsoft rated it Important. Identity teams should not
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- CVEFreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI fla
- CVEWindows Kerberos elevation of privilege
A 2026 Windows Kerberos elevation of privilege, patched by Microsoft. High severity. Read it next to KerberLoss and ResetNightmare: the 2026 AD year is a Kerber