CVE-2025-21242Windows Kerberos information disclosure
What broke
Windows Kerberos leaked information a low-privileged caller should not have seen. Medium severity. Microsoft patched it in the January 2025 updates.
Why it matters
Info-disclosure on the KDC is how you seed the next escalation: usernames, etypes, or ticket metadata that make password spraying and delegation abuse cheaper. It is not CheckSum, and you should not brief it that way. You should still take the patch, because Kerberos updates ship as a train.
What to do
- Keep DCs current. Do not skip "medium" Kerberos CVEs to save a change window.
- Monitor for unusual TGS requests after you patch. Disclosure bugs sometimes show up in tooling before they show up in tickets.
After you patch
Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.
- Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
- Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
- Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.
Sources
Related identity CVEs
Related on Start with Identity
- CVEWindows Kerberos elevation of privilege
A 2026 Windows Kerberos elevation of privilege, patched by Microsoft. High severity. Read it next to KerberLoss and ResetNightmare: the 2026 AD year is a Kerber
- CVEWindows Kerberos PAC validation in cross-forest scenarios
The forest-trust sibling of CVE-2024-26248. PAC validation could be skipped across a trust. Same April 2024 patch train, same staged enforcement.
- CVEWindows Kerberos PAC validation spoof, KB5020805 bypass
A process could spoof the PAC signature and skip the CVE-2022-37967 checks Microsoft added in KB5020805. April 2024. Enforcement is staged: both DCs and clients
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa