# CVE-2025-53779 (BadSuccessor): Windows Kerberos Privilege Escalation

<figure><img src="https://131623695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpi5i0edb1IMOoSqHBNmV%2Fuploads%2FYbIYrqTvVspKHD7PMYnx%2FCVE-2025-53779%20BadSuccessor.png?alt=media&#x26;token=d73dfdf4-ab96-4cb1-b3eb-c08fa0b4cf76" alt=""><figcaption></figcaption></figure>

## Overview <a href="#ember63" id="ember63"></a>

[CVE-2025-53779](https://nvd.nist.gov/vuln/detail/CVE-2025-53779), also known as **“BadSuccessor”**, is a newly disclosed **network-based elevation-of-privilege vulnerability** in Windows Kerberos. Patched in **August 2025**, this zero-day impacts **Windows Server environments running Active Directory**, specifically through the delegated Managed Service Account (dMSA) feature introduced in Windows Server 2025.

* **CVE ID:** CVE-2025-53779
* **CVSS Score:** 7.2 (High)
* **Impact:** Full compromise of **confidentiality, integrity, and availability** across affected domains
* **Status:** Patched (August 2025 Patch Tuesday)
* **Exploitation in the Wild:** None confirmed, but **proof-of-concept code is available**

## Exploit Timeline <a href="#ember66" id="ember66"></a>

* **Early 2025** – Vulnerability discovered during security research into dMSA delegation.
* **July 2025** – Privately reported to Microsoft via MSRC.
* **August 12, 2025** – Patched as part of **Patch Tuesday** release.
* **August 13, 2025** – Public disclosure of CVE-2025-53779; dubbed **“BadSuccessor.”**
* **Mid-August 2025** – Proof-of-concept exploit code released publicly.
* **Current (August 2025)** – No confirmed in-the-wild exploitation, but weaponization risk is **high** given AD value.

## Attack Details & Impact <a href="#ember68" id="ember68"></a>

* **Attack Vector:** Network-based, requiring an authenticated attacker with elevated Active Directory privileges.
* **Mechanism:** Exploits **improper validation of path inputs for dMSAs**, focusing on attributes such as:
* **Result:** Attackers can craft **malicious delegation chains** to impersonate privileged accounts (including **domain admin**), enabling domain-wide or cross-forest escalation.

### Risks include: <a href="#ember70" id="ember70"></a>

* **Full Domain Compromise** – attackers gain domain admin rights, disable monitoring, alter GPOs, and cover tracks.
* **Supply Chain Propagation** – escalation may cross into **partner or multi-forest environments**.
* **Insider Abuse** – malicious insiders with sufficient privileges can escalate with ease.

## Affected Systems <a href="#ember72" id="ember72"></a>

* All supported **Windows Server versions** with Kerberos enabled
* **Domain Controllers** managing Kerberos and dMSA accounts
* Environments leveraging **Windows Server 2025 dMSAs**

> Microsoft estimates **\~0.7% of Active Directory domains remain vulnerable**. Risk increases significantly in organizations deploying dMSAs.

## Comparison to Previous Kerberos Vulnerabilities <a href="#ember75" id="ember75"></a>

“BadSuccessor” fits into a broader history of **Kerberos-related privilege escalation flaws**:

* [**CVE-2022-26923**](https://nvd.nist.gov/vuln/detail/cve-2022-26923) **“Certifried”** – Exploited certificate mapping in Active Directory to escalate privileges and impersonate domain controllers.
* [**CVE-2020-17049**](https://nvd.nist.gov/vuln/detail/cve-2020-17049) **“Bronze Bit”** – Kerberos KDC vulnerability allowing attackers to bypass PAC signature validation.
* [**CVE-2014-6324**](https://nvd.nist.gov/vuln/detail/cve-2014-6324) **(Golden Ticket / MS14-068)** – Infamous bug where attackers could forge Kerberos tickets to gain domain admin rights.

### What’s Different? <a href="#ember78" id="ember78"></a>

* Unlike older flaws (ticket forgery, PAC bypass), **CVE-2025-53779 abuses dMSA delegation paths**, a relatively new feature in Windows Server 2025.
* It highlights how **new Active Directory features can introduce high-impact vulnerabilities**, even if exploitation requires initial elevated privileges.

## Defensive Measures <a href="#ember80" id="ember80"></a>

1. **Patch Immediately** – Deploy Microsoft’s **August 2025 Patch Tuesday** Kerberos update on all domain controllers and servers.
2. **Audit dMSA Deployments** – Review and limit delegated Managed Service Accounts. Validate account attributes and delegation chains.
3. **Monitor for Anomalies** – Configure SIEM/EDR to detect unusual delegation or privilege escalation attempts.
4. **Restrict Privileges** – Ensure only trusted admins can create or modify service accounts and delegation settings.

No practical mitigations exist for unpatched systems besides disabling dMSA — which may be operationally disruptive.

## Closing Words <a href="#ember83" id="ember83"></a>

“BadSuccessor” represents a **network-wide escalation path** that bypasses traditional exploit chains. While Microsoft marks exploitation as *less likely*, the existence of PoC code and its **high-value target (Active Directory)** make this a priority vulnerability.

## References <a href="#ember85" id="ember85"></a>

* [Microsoft Security Update Guide – CVE-2025-53779](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53779)
* [Help Net Security: Microsoft Fixes BadSuccessor](https://www.helpnetsecurity.com/2025/08/13/microsoft-fixes-badsuccessor-kerberos-vulnerability-cve-2025-53779/)
* [Tenable Patch Tuesday Analysis](https://www.tenable.com/blog/microsofts-august-2025-patch-tuesday-addresses-107-cves-cve-2025-53779)
* [CrowdStrike August 2025 Patch Overview](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-august-2025/)
* [NVD Entry – CVE-2025-53779](https://nvd.nist.gov/vuln/detail/CVE-2025-53779)
