BadSuccessor in Windows Kerberos dMSA
CVE-2025-53779 is a Windows Kerberos elevation-of-privilege vulnerability, publicly referred to as BadSuccessor, affecting Active Directory environments that use delegated Managed Service Accounts (dMSAs), a feature introduced in Windows Server 2025. The issue is described by Microsoft as a relative path traversal flaw in Windows Kerberos. Supporting reporting indicates the practical exploitation path abuses dMSA migration/successor linkage handling so that the Key Distribution Center (KDC) can be induced to treat an attacker-controlled dMSA as the legitimate successor of an arbitrary target account. Pre-patch research cited in the content states that CreateChild on an OU or container was sufficient to create a dMSA with an arbitrary superseded-account target, using one-sided link manipulation to obtain the target account’s credentials. Microsoft’s patch reportedly added KDC-side validation requiring bidirectional links before issuing the credential package. Successful exploitation can result in compromise of highly privileged accounts, including Domain Admins and domain controllers.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a PowerShell script, Invoke-BadSuccessor.ps1, and a README.md. The script is a fully automated exploit targeting the BadSuccessor vulnerability (CVE-2025-53779) in Windows Server 2025 Active Directory environments. It abuses misconfigured Delegated Managed Service Account (dMSA) creation rights in Organizational Units (OUs) to escalate privileges. The script identifies OUs where the attacker has CreateChild rights, creates or reuses a computer account and a dMSA, grants the attacker full control over the dMSA, and links it to a privileged account. It then provides post-exploitation instructions for forging Kerberos tickets using Rubeus, enabling impersonation of privileged users. The exploit requires the RSAT ActiveDirectory PowerShell module and is intended for use in environments where the attacker already has some level of access. The repository is well-documented, with the README providing detailed usage instructions, function descriptions, and post-exploitation steps. No external network endpoints are hardcoded; all operations are performed against the local Active Directory environment via the PowerShell AD provider and LDAP.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A patched Windows Server 2025 dMSA vulnerability in which one-sided link manipulation allowed creation of a dMSA with an arbitrary superseded account target, enabling the KDC to issue the target's credentials.
A Windows Kerberos elevation of privilege vulnerability reported as exploited.
A privilege escalation vulnerability in Kerberos (BadSuccessor) allowing any domain authenticated account to escalate privileges by spoofing tokens in Active Directory, potentially leading to domain admin compromise. Called a 'gift to ransomware operators.'
A zero-day elevation of privilege vulnerability in Microsoft Kerberos, enabling attackers to escalate privileges and move laterally within domains.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.