CVE-2025-53779

HIGH

Windows Kerberos - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2025-53779. PoCs published by b5null, razureink, Musa-xvi.

AI-analyzed exploit summary This PowerShell script exploits CVE-2025-53779 by enumerating Active Directory ACLs to identify OUs where a user has CreateChild rights, enabling privilege escalation via child object creation. It includes functions to filter default SIDs and admin groups, focusing on non-standard permissions.

Description

Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

Exploits (4)

nomisec WORKING POC 44 stars
by b5null · poc
https://github.com/b5null/Invoke-BadSuccessor.ps1

This PowerShell script exploits CVE-2025-53779 by enumerating Active Directory ACLs to identify OUs where a user has CreateChild rights, enabling privilege escalation via child object creation. It includes functions to filter default SIDs and admin groups, focusing on non-standard permissions.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Active Directory (specific version not specified)
Auth required
Prerequisites: Active Directory environment · RSAT ActiveDirectory module · Valid user credentials with some AD permissions
mistral-large-3 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by razureink · poc
https://github.com/razureink/cve-2025-53779-kerberos_bypass_reproduction

This repository contains a functional exploit for CVE-2025-53779, a critical Kerberos authentication bypass vulnerability in Microsoft Windows Server KDC. The exploit forges a TGT for any domain user without credentials by manipulating the PA-PAC-REQUEST structure to bypass PAC validation.

Classification
Working Poc 98%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows Server (KDC service in kdsvc.dll), all versions prior to August 2025 patch
No auth needed
Prerequisites: Network access to a vulnerable Windows domain controller (port 88/TCP or UDP) · Target domain name and user principal name (UPN) · Python 3.8+ with impacket and pycryptodome libraries
mistral-large-3 · analyzed Jul 24, 2026 Full analysis →
github STUB
by Musa-xvi · poc
https://github.com/Musa-xvi/Active-Directory-BadSuccessor

The repository contains only a minimal README with no technical details or exploit code. It references a TryHackMe room but provides no actionable information about CVE-2025-53779.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Active Directory (version unspecified)
No auth needed
Prerequisites: none specified
mistral-large-3 · analyzed Jun 05, 2026 Full analysis →
github SCANNER
by wnaspy · powershellpoc
https://github.com/wnaspy/CVE-POC-WEAPON/tree/main/CVE-2025-53779.ps1

The repository contains a PowerShell script designed to scan Active Directory for misconfigured ACLs, specifically identifying OUs where a user or their groups have CreateChild rights. It does not exploit CVE-2025-53779 but provides detection capabilities for potential privilege escalation paths.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Active Directory (version not specified)
Auth required
Prerequisites: Active Directory environment · RSAT ActiveDirectory module · Valid AD credentials
mistral-large-3 · analyzed Mar 09, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 7.2
EPSS 0.0260
EPSS Percentile 83.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-23
Status published
Products (1)
microsoft/windows_server_2025 < 10.0.26100.4851
Published Aug 12, 2025
Tracked Since Feb 18, 2026