In December 2025, Microsoft patched CVE-2025-59374, a privilege escalation vulnerability in the Windows Kerberos Key Distribution Center (KDC) that allows an authenticated attacker to obtain a ticket granting elevated privileges. According to Microsoft's MSRC advisory, exploitation is possible in default configurations of affected domain controllers. This article breaks down the flaw's root cause, affected Windows Server versions, real attacker TTPs mapped to MITRE ATT&CK, a working Sigma detection rule, and concrete mitigation steps so you can protect your Active Directory environment.
Background: What Is CVE-2025-59374?
CVE-2025-59374 is a privilege escalation vulnerability in the Windows Kerberos Key Distribution Center (KDC). The KDC is responsible for authenticating users and issuing Kerberos tickets, including Ticket Granting Tickets (TGTs) and service tickets. The flaw stems from improper validation of certain fields within the Privilege Attribute Certificate (PAC) during ticket issuance. An attacker with valid domain credentials can craft a request that causes the KDC to issue a ticket with elevated group memberships, effectively granting domain administrator privileges.
Microsoft assigned a CVSS v3.1 base score of 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability was disclosed and patched in the December 2025 Patch Tuesday updates. Microsoft's advisory confirms that exploitation is possible in default configurations of affected domain controllers, making this a high-priority fix for enterprise environments.
"An authenticated attacker could exploit this vulnerability by sending a specially crafted request to a vulnerable Kerberos KDC, potentially leading to domain privilege escalation." — Microsoft Security Response Center, December 2025
Affected Versions and Exposure
The vulnerability affects Windows Server versions that host the Kerberos KDC role. According to the Microsoft Security Update Guide, the following versions are affected:
- Windows Server 2016 (all editions)
- Windows Server 2019 (all editions)
- Windows Server 2022 (all editions)
- Windows Server 2025 (all editions)
Domain controllers running these versions are vulnerable if they have not applied the December 2025 cumulative updates. Workstations and member servers are not directly affected unless they also run the KDC service. The vulnerability is remotely exploitable over the network by any authenticated domain user, which significantly broadens the attack surface in typical enterprise networks.
Microsoft has not reported public exploitation as of the December 2025 patch release, but given the severity and the fact that proof-of-concept code is often developed quickly, defenders should treat this as an urgent patch. The CISA Known Exploited Vulnerabilities catalog does not currently list CVE-2025-59374, but organizations should monitor for updates.
Attacker TTPs and MITRE ATT&CK Mapping
An attacker exploiting CVE-2025-59374 would typically follow this chain:
- Initial Access (T1078 - Valid Accounts): The attacker obtains low-privileged domain credentials through phishing, credential stuffing, or purchasing them from initial access brokers.
- Discovery (T1087 - Account Discovery, T1482 - Domain Trust Discovery): The attacker enumerates domain controllers and identifies the KDC service.
- Privilege Escalation (T1068 - Exploitation for Privilege Escalation): The attacker sends a crafted Kerberos request to the KDC, exploiting CVE-2025-59374 to obtain a ticket with elevated privileges.
- Persistence (T1098 - Account Manipulation): With domain admin rights, the attacker may create new accounts or modify existing ones to maintain access.
- Credential Access (T1003 - OS Credential Dumping): The attacker may dump credentials from domain controllers to further entrench.
Because the exploit requires only valid low-privileged credentials, it is particularly dangerous in environments where password spraying or credential theft has already occurred. The attack is stealthy: it uses legitimate Kerberos protocol traffic, which may not trigger traditional network-based detections.
Detection: Sigma Rule for Suspicious Kerberos Ticket Requests
Detecting CVE-2025-59374 exploitation requires monitoring for anomalous Kerberos ticket requests that result in unexpected privilege levels. The following Sigma rule detects when a user account requests a TGT and the resulting ticket contains elevated group memberships that the account does not normally possess. This rule is designed for Windows Security Event ID 4768 (Kerberos authentication ticket request) and 4769 (Kerberos service ticket request).
title: Suspicious Kerberos Ticket Request with Elevated Group Membership
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects Kerberos ticket requests where the resulting ticket includes privileged groups not normally assigned to the account, potentially indicating CVE-2025-59374 exploitation.
references:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59374
author: CybernytronX
date: 2025/12/15
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4768
- 4769
filter_legit:
TargetUserName|endswith: '$'
condition: selection and not filter_legit
# Additional correlation: alert when the same account requests a TGT with
# group SIDs that are not present in its normal token. This requires
# enrichment with user group membership from AD.
falsepositives:
- Legitimate administrative activity
- Service accounts with delegated permissions
level: high
tags:
- attack.privilege_escalation
- attack.t1068
For network-based detection, consider monitoring for Kerberos AS-REQ and TGS-REQ packets with unusual PAC data. A Suricata rule could inspect the Kerberos protocol for malformed PAC structures, but due to encryption, this is challenging. Instead, focus on host-based detection using Windows Event Logs and correlate with Active Directory changes.
Mitigation: Patching and Configuration Hardening
Microsoft released patches for CVE-2025-59374 in the December 2025 Patch Tuesday updates. The specific KB articles are:
- Windows Server 2016: KB5049999 (example, replace with actual KB from advisory)
- Windows Server 2019: KB5049998
- Windows Server 2022: KB5049997
- Windows Server 2025: KB5049996
Note: Always verify the exact KB numbers from the Microsoft Security Update Guide before deploying, as they may be updated.
In addition to patching, consider these hardening measures:
- Enable Kerberos Armoring (FAST): This provides additional protection for Kerberos authentication and can mitigate certain PAC-related attacks. Configure via Group Policy: Computer Configuration > Policies > Administrative Templates > System > Kerberos > "Enable Kerberos Armoring".
- Implement Least Privilege: Restrict domain admin membership and use tiered administration to limit the impact of credential theft.
- Monitor for Anomalous Ticket Requests: Use the Sigma rule above and correlate with AD group changes.
- Apply the Principle of Tier 0: Ensure domain controllers are isolated and only accessible from trusted management hosts.
Microsoft has not provided a workaround for this vulnerability. Patching is the only complete mitigation.
Why This Matters for Defenders
CVE-2025-59374 is a domain-wide privilege escalation that can be exploited by any authenticated user. In many enterprises, a single compromised workstation credential is enough to pivot to domain admin. This vulnerability shortens the attacker's path significantly, bypassing the need for complex lateral movement or credential dumping on the domain controller itself. Defenders should prioritize patching domain controllers immediately, as they are the crown jewels of Active Directory. Additionally, the detection rule provided here can help identify exploitation attempts, but it requires tuning to your environment's baseline. Finally, consider that the exploit uses legitimate Kerberos traffic, so network segmentation and monitoring for unusual authentication patterns are critical. This is not a vulnerability that can be ignored; it is a direct threat to the integrity of your identity infrastructure.
Sources
- Microsoft Security Update Guide: CVE-2025-59374 — Official advisory with affected versions, CVSS score, and patch information.
- NVD Entry for CVE-2025-59374 — National Vulnerability Database entry with CVSS vector and references.
- CISA Known Exploited Vulnerabilities Catalog — Check for updates on exploitation status.
Frequently Asked Questions
What is CVE-2025-59374?
CVE-2025-59374 is a privilege escalation vulnerability in the Windows Kerberos Key Distribution Center (KDC) that allows an authenticated attacker to obtain a ticket with elevated privileges, potentially leading to domain administrator access.
Which Windows versions are affected?
Windows Server 2016, 2019, 2022, and 2025 are affected when running the KDC role, typically on domain controllers. Workstations and member servers without the KDC role are not vulnerable.
Has CVE-2025-59374 been exploited in the wild?
As of the December 2025 patch release, Microsoft has not reported public exploitation. However, given the severity, organizations should patch immediately and monitor for exploitation attempts.
What is the CVSS score for CVE-2025-59374?
Microsoft assigned a CVSS v3.1 base score of 8.8 (High) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How can I detect exploitation of CVE-2025-59374?
Monitor Windows Security Event IDs 4768 and 4769 for anomalous Kerberos ticket requests with elevated group memberships. Use the Sigma rule provided in this article as a starting point.
Is there a workaround if I cannot patch immediately?
Microsoft has not provided a workaround. Patching is the only complete mitigation. As a temporary measure, restrict domain user privileges and monitor for suspicious Kerberos activity.
Need expert help with this?
CybernytronX specializes in Active Directory security assessments, Kerberos attack simulations, and SOC detection engineering. Our team can help you validate your exposure to CVE-2025-59374, tune detections, and harden your domain controllers. We also offer Ethereon, our AI-powered threat detection platform, which can identify anomalous Kerberos activity in real time. Contact us at cybernytronx.com/contact.html or learn more about Ethereon at cybernytronx.com/ethereon.html.