CVE-2026-25177KerberLoss, invisible-Unicode SPN uniqueness bypass
What broke
Active Directory's SPN uniqueness check did not treat invisible-Unicode look-alikes as collisions. An attacker who can write an SPN registers a twin of HTTP/app.contoso.com, intercepts Kerberos traffic, and can downgrade the client to NTLM. Semperis and Shai Laron named it KerberLoss. CVSS 8.8. Microsoft patched in March 2026.
Why it matters
SPN uniqueness is the only thing standing between "I can write a servicePrincipalName" and "I am the app." Combined with Ghost SPNs and ResetNightmare, 2026 made AD's name-uniqueness story look as fragile as SAML's signature-binding story.
What to do
- Deploy the March 2026 AD / Kerberos updates on every DC.
- Alert on new SPNs that contain non-ASCII characters. There is almost never a business reason.
- Restrict
Validated write to service principal nameto the smallest set of computer accounts that need it. - Semperis published detection guidance. Use it even after you patch.
After you patch
Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.
- Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
- Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
- Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.
Sources
- NVD: CVE-2026-25177
- Semperis / Shai Laron, KerberLoss
Related identity CVEs
Related on Start with Identity
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- CVEWindows Kerberos elevation of privilege
A 2026 Windows Kerberos elevation of privilege, patched by Microsoft. High severity. Read it next to KerberLoss and ResetNightmare: the 2026 AD year is a Kerber
- CVEWindows Kerberos information disclosure
A medium-severity Kerberos information-disclosure in Windows. Not a domain-compromise bug on its own, but it sits in the same 2025 Kerberos patch train as the S
- RankingBest ITDR for Active Directory: Top 5 AD Security Platforms
The best ITDR platforms for Active Directory in 2026: Semperis, Microsoft Defender for Identity, Silverfort, Cayosoft, and Quest Change Auditor. Ranked for AD t
- GuideIAM Cloud Migration Guide: From On-Prem Active Directory to Cloud Identity
A practical guide to migrating from on-premises Active Directory to cloud IAM, covering hybrid identity architecture, migration phases, coexistence strategies,
Technique
This CVE is an instance of Kerberoasting. Any authenticated domain user can request a Kerberos service ticket for any service principal, and that ticket is encrypted with the service account's own password hash, offline and unrateable to test.