BadSuccessor: How to Detect and Mitigate dMSA Privilege Escalation

BadSuccessor lets attackers abuse dMSAs on Windows Server 2025 to impersonate any account, including Domain Admins. A schema-level fix blocks the dMSA migration abuse until Microsoft patches it.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

A design flaw in Windows Server 2025 dMSAs enables the Golden dMSA attack: attackers with a KDS root key can generate passwords for all managed service accounts offline, bypassing authentication.

CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.

Bugcrowd releases VRT 1.8, adding race condition and cache poisoning entries, a new Indicators of Compromise category, and downgrading mobile clipboard findings to P5.

A Google Project Zero blog post examining a Windows privilege escalation technique involving dangling COM object registrations, which Microsoft addressed in a recent security update.