---
id: 7747
title: "CVE-2025-26685 – Spoofing to Elevate Privileges with Microsoft Defender for Identity"
cve: CVE-2025-26685
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/network-pentesting/microsoft-defender-for-identity-spoofing-cve-2025-26685/"
published_at: "2025-06-12T00:00:00Z"
tags: ["active-directory", "privilege-escalation", "ntlm", "spoofing", "cve-2025-26685", "microsoft-defender-for-identity"]
phying_url: "https://phying.com/item/7747"
lang: en
---

# CVE-2025-26685 – Spoofing to Elevate Privileges with Microsoft Defender for Identity

## Summary

CVE-2025-26685 lets an unauthenticated attacker on the local network coerce the Defender for Identity sensor into NTLM authentication, capturing the DSA's Net-NTLM hash for cracking or relay attacks.

## Intelligence Metadata

- **Sources:** netspi.com
- **CVE:** CVE-2025-26685
- **Published:** 2025-06-12T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/network-pentesting/microsoft-defender-for-identity-spoofing-cve-2025-26685/
- **Phying News:** https://phying.com/item/7747