Start with Identity

CVE-2025-58726SMB Server Kerberos reflection via Ghost SPNs

high
Product: Windows SMB ServerVendor: MicrosoftDisclosed: 2025-10-14Status: PatchedNVD ↗

What broke

CVE-2025-58726 is the October 2025 SMB Server elevation of privilege that takes CVE-2025-33073's Kerberos reflection and pairs it with Ghost SPNs created through DNS self-registration. Microsoft patched it in the October 2025 updates.

Why it matters

DNS self-registration is on by default in most AD shops. That convenience is now part of an elevation chain. KerberLoss later showed another way to play with SPN uniqueness. SPNs are identity, not inventory trivia.

What to do

  • Patch Windows Server for October 2025.
  • Disable insecure dynamic DNS updates where you can. Monitor new SPN writes on privileged computer accounts.
  • Cross-check with CVE-2026-25177 (invisible-Unicode SPN bypass) when you write the AD hardening ticket.

After you patch

Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.

  • Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
  • Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
  • Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
  • Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
  • Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.

Sources

Last reviewed By SWI Community TeamSuggest a correctionHow we research

Technique

This CVE is an instance of Kerberos delegation abuse. Delegation lets a service act as the user who called it, which is necessary for multi-tier applications and dangerous the moment the service or the delegation scope is not exactly what an administrator intended.

Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.