CVE-2025-26685 – Spoofing to Elevate Privileges with Microsoft Defender for Identity

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Kevin Robertson expands on ADIDNS attacks, covering why WPAD records fail against the global query block list and demonstrating GQBL bypasses with wildcard, DNAME, and NS records.

Trail of Bits dissects the NSA-discovered Windows CryptoAPI flaw in Crypt32.dll, where improper ECC curve parameter validation lets attackers forge HTTPS and code-signing certificates.

A Google Project Zero blog post examining a Windows privilege escalation technique involving dangling COM object registrations, which Microsoft addressed in a recent security update.

CVE-2026-55040: SharePoint Server Subscription Edition's token handler skips JWT signature validation, letting attackers forge Bearer tokens and log in as arbitrary accounts, including site admins.

The official CVSS 3.1 vector requires local low-privilege access, but attack complexity is low, no user interaction is required, and successful exploitation can fully impact confidentiality, integrity, and availability. Apply the latest Microsoft security update for each Windows release; also enforce SMB signing, restrict NTLM, and monitor for unusual local SMB relay activity. Public information currently confirms a PoC, not active exploitation in the wild.