CVE-2024-26248Windows Kerberos PAC validation spoof, KB5020805 bypass
What broke
The Kerberos Privilege Attribute Certificate (PAC) carries the user's groups and privileges. After CVE-2022-37967, Microsoft added PAC signature checks (KB5020805). CVE-2024-26248 lets a local attacker spoof that signature and skip the check, elevating on the workstation. CVE-2024-29056 is the cross-forest sibling. Patched 9 April 2024. Enforcement is staged: both DCs and clients need the update or authentication can fail.
Why it matters
PAC is how a service knows who you are after the TGT. Bypassing PAC validation is forging group membership. Identity teams who treated KB5020805 as "done in 2023" had to reopen the change in April 2024, then again for the 2025 PKINIT and S4U bugs.
What to do
- Deploy April 2024 updates on DCs first, then members, then flip the PAC-validation enforcement mode Microsoft documented for 26248 / 29056.
- Do not skip the client-side update. A patched DC and an unpatched workstation is how you get "Kerberos is broken" tickets.
- Inventory service accounts that accept unconstrained delegation. PAC spoofing loves those.
After you patch
Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.
- Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
- Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
- Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.
Sources
- NVD: CVE-2024-26248
- Microsoft, "How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056"
Related identity CVEs
Related on Start with Identity
- CVEWindows Kerberos elevation of privilege
A 2026 Windows Kerberos elevation of privilege, patched by Microsoft. High severity. Read it next to KerberLoss and ResetNightmare: the 2026 AD year is a Kerber
- CVEWindows Kerberos information disclosure
A medium-severity Kerberos information-disclosure in Windows. Not a domain-compromise bug on its own, but it sits in the same 2025 Kerberos patch train as the S
- CVEWindows Kerberos PKINIT / NTAuth certificate logon bypass
The Windows KDC did not validate certificate-based logon (PKINIT) against NTAuth the way defenders thought. Remote elevation of privilege. Patched April 2025, w
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa