10/16/2026
An Active Directory flaw, CVE-2026-25177 (CVSS 8.8), disclosed earlier this year, lets a standard authenticated domain user escalate privileges over the network, with no user interaction required.
Patching your domain controllers should be priority one, but it doesn’t fix the deeper issue: years of excessive native permissions, ungoverned service accounts and inconsistent policies across domains and tenants. Moving AD administration to a least-privilege governance layer removes much of the exploitable surface that vulnerabilities like this depend on. Pair that with monitoring for unusual SPN changes, disabling NTLM where possible and regular permission audits to build real resilience.
Get a full breakdown in this blog. ➡️ https://www.oneidentity.com/community/blogs/b/active-directory-management-and-security/posts/why-active-directory-vulnerabilities-demand-more-than-patching