KerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade. Patched March 2026.
CVE-2026-25177 is the Active Directory SPN uniqueness bypass Semperis and Shai Laron named KerberLoss. AD did not treat invisible-Unicode look-alikes as collisions, so an attacker who can write an SPN registers a twin of HTTP/app.contoso.com, intercepts Kerberos traffic, and can downgrade the client to NTLM. CVSS 8.8. Microsoft patched it in March 2026.
This sits next to the 2025 Ghost SPN / SMB reflection work. SPNs are identity, not inventory trivia. We filed the brief under Kerberos / Active Directory with a concrete hunt: new SPNs that contain non-ASCII characters. There is almost never a business reason.
Why it matters
SPN uniqueness is the only thing standing between "I can write a servicePrincipalName" and "I am the app." If your delegation graph or DNS self-registration is messy, this CVE is how that mess becomes a ticket.
If you have not confirmed the March 2026 AD updates on every DC, do that, then restrict validated write to servicePrincipalName. The KerberLoss brief has the detection notes.
Source: NVD: CVE-2026-25177
Related on Start with Identity
- BlogResetNightmare: a low-priv UPN write can reset a Domain Admin via Kerberos kpasswd
CVE-2026-27912 lets a user who can write their own UPN aim a Kerberos change-password at a Domain Admin. Microsoft rated it Important. Identity teams should not
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- BlogCertighost lets any domain user forge a Domain Controller certificate
A low-privileged Active Directory account, no admin rights required, can now obtain a certificate for a Domain Controller and DCSync the krbtgt secret. Microsof
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- CVEWindows Kerberos elevation of privilege
A 2026 Windows Kerberos elevation of privilege, patched by Microsoft. High severity. Read it next to KerberLoss and ResetNightmare: the 2026 AD year is a Kerber
- CVEWindows Kerberos information disclosure
A medium-severity Kerberos information-disclosure in Windows. Not a domain-compromise bug on its own, but it sits in the same 2025 Kerberos patch train as the S