Topic starter
25/06/2026 12:19 am
TL;DR: A Windows Kerberos constrained delegation flaw in CVE-2025-60704 let attackers impersonate arbitrary users and escalate privileges through S4U validation failures, according to Silverfort. The deeper lesson is that trust paths built for controlled impersonation can become privilege-swapping channels when validation breaks and monitoring lags.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “You win some, you CheckSum: New Kerberos delegation vulnerability discovered—attackers could impersonate, escalate privileges and stay hidden”.
By the numbers:
- The vulnerability received a CVSS score of 7.5 in Microsoft’s November 11, 2025 update.
Key questions
Q: What breaks when Kerberos delegation validation is weakened?
A: When Kerberos delegation validation is weakened, attackers can manipulate the identity carried through the delegation path and cause a system to accept a different user than intended.
Q: Why does Kerberos delegation on machine accounts create higher-risk escalation paths?
A: Because machine identities often hold authority equivalent to privileged users, delegation on those objects can convert a weak entry point into domain-level control.
Q: What are the signs that Kerberos delegation is being abused in a Windows domain?
A: Look for services using unconstrained delegation, unexpected delegation flags on service accounts, and tickets being issued for users that should not be delegable.
Practitioner guidance
- Patch Kerberos delegation flaws immediately Prioritise Windows and Active Directory patching for CVE-2025-60704 in any environment that uses Kerberos constrained delegation, especially where privileged accounts or sensitive backend services are in scope.
- Monitor constrained delegation activity Use ITDR detections to alert on unusual Kerberos constrained delegation flows, including unexpected S4U2Self and S4U2Proxy patterns that could indicate impersonation abuse.
- Inventory delegation paths and owners Map every application and service account that can delegate on behalf of users, then assign an explicit business owner and review cadence for each trust path.
Bottom line: Kerberos delegation can be abused when validation fails, turning a controlled impersonation feature into a privilege-escalation path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
25/06/2026 9:12 am
Kerberos delegation trust was designed for controlled impersonation, not identity substitution. That assumption fails when validation defects let an attacker change who the service is acting for after the trust decision has already been made. The implication is that delegation governance must be treated as a high-risk privilege path, not a convenience feature.
A question worth separating out:
Q: Who is accountable when a Kerberos delegation flaw leads to domain compromise?
A: Accountability sits with the teams responsible for patching, identity governance, and detection across Active Directory and dependent applications. If delegated access is not inventoried, monitored, and remediated quickly, the organisation is effectively accepting a domain-wide trust risk that a single flaw can exploit.
👉 Read our full editorial: Kerberos delegation flaws expose privilege escalation in Active Directory
This post was modified 5 days ago by NHI Mgmt Group