New Attack Chains Ghost SPNs and Kerberos Reflection to Elevate SMB Privileges

Microsoft has addressed a critical privilege escalation vulnerability affecting Windows environments worldwide.

Attackers can exploit misconfigured Service Principal Names (SPNs) combined with Kerberos reflection attacks to gain SYSTEM-level access on domain-joined machines, even when previous Kerberos mitigations are in place.

Attribute	Details
CVE ID	CVE-2025-58726
Vulnerability Type	SMB Server Elevation of Privilege
CVSS 3.1 Score	8.8 (High)
Attack Vector	Network

The vulnerability, cataloged as CVE-2025-58726, reveals how Ghost SPNs service names referencing hostnames that don’t resolve in DNS create exploitable attack surfaces in Active Directory environments.

Security researchers reported the vulnerability to Microsoft in June 2025, and the company released patches during October’s Patch Tuesday update.

Understanding the Attack Mechanism

Ghost SPNs occur for legitimate reasons including legacy systems, pre-staged services, configuration errors, or cross-forest setups.

However, these orphaned SPNs become dangerous when combined with default Active Directory permissions and weak SMB security controls.

The attack exploits Kerberos authentication reflection, a technique where attackers capture authentication requests from victim machines and reflect them back to the same service.

Unlike NTLM reflection, which has been mitigated for years, Kerberos lacks universal reflection detection mechanisms.

This gap enables attackers to trick domain-joined machines into authenticating to attacker-controlled endpoints.

A low-privilege domain user can register DNS records by default in Active Directory. By creating a DNS entry for a Ghost SPN pointing to their controlled IP address, attackers redirect authentication attempts.

When the target machine requests a Kerberos service ticket for the Ghost SPN, it unknowingly authenticates as its own computer account, which the operating system maps to SYSTEM-level privileges.

The exploit requires specific conditions: a domain-joined Windows machine without enforced SMB signing, presence of a Ghost SPN, domain user access to register DNS records, and the ability to trigger machine authentication through coercion techniques like the Print Spooler vulnerability.

Once successful, attackers gain remote code execution with SYSTEM privileges. If the compromised machine is a Tier 0 asset such as an Active Directory Certificate Services server, attackers can escalate to complete domain compromise, potentially affecting the entire infrastructure.

Microsoft’s patch modifies the SMB driver to detect and terminate non-local connections attempting Kerberos reflection attacks. Organizations should immediately apply October 2025 security updates across all Windows versions.

Beyond patching, critical mitigations include enforcing SMB signing across all domain-joined machines, regularly auditing and removing misconfigured SPNs, restricting DNS write permissions for standard users, and monitoring Kerberos traffic for suspicious service ticket requests.

Patching known coercion vulnerabilities and disabling unnecessary RPC services further hardens defenses against this attack chain.

The discovery underscores how legacy infrastructure elements, combined with default permissions and authentication weaknesses, create exploitable attack paths in enterprise environments.

Organizations must adopt a comprehensive approach addressing misconfigurations, access controls, and network security simultaneously.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.