PT-2025-20940 · Microsoft · Defender For Identity

Joshua Murrell

·

Published

2025-05-13

·

Updated

2025-07-21

·

CVE-2025-26685

CVSS v3.1

6.5

Medium

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Microsoft Defender for Identity (affected versions not specified)
Description: The issue is related to improper authentication in Microsoft Defender for Identity, allowing an unauthorized attacker to perform spoofing over an adjacent network. This can lead to the capture of Net-NTLM hashes of Directory Service Accounts, enabling privilege escalation in Active Directory environments. The vulnerability is actively exploited and can be used to gain access to Active Directory.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2025-05782
CVE-2025-26685

Affected Products

Defender For Identity