CVE-2025-26685

Published May 13, 2025

Last updated a month ago

Microsoft Defender

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-26685 is an improper authentication vulnerability affecting Microsoft Defender for Identity. It allows an unauthorized attacker on an adjacent network to perform spoofing. Specifically, an unauthenticated attacker with local network access can coerce and capture the Net-NTLM hash of the Directory Service Account (DSA) associated with the MDI sensor. This vulnerability abuses the Lateral Movement Paths (LMPs) feature. By initiating a connection to a Domain Controller, an attacker can trigger the MDI sensor to authenticate and query the attacker's system for members of the Local Administrators group. This can lead to the attacker gathering information about the domain and potentially escalating privileges in Active Directory environments.

Description: Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network.
Source: secure@microsoft.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

secure@microsoft.com: CWE-287

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 8

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:defender_for_identity:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D8FA2658-B73C-4350-B0E4-4567CAD3DAF7"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.