Microsoft · Defender For Identity · CVE-2025-26685
Name of the Vulnerable Software and Affected Versions:
Microsoft Defender for Identity (affected versions not specified)
Description:
The issue is related to improper authentication in Microsoft Defender for Identity, allowing an unauthorized attacker to perform spoofing over an adjacent network. This can lead to the capture of Net-NTLM hashes of Directory Service Accounts, enabling privilege escalation in Active Directory environments. The vulnerability is actively exploited and can be used to gain access to Active Directory.
Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.