Researcher Details Windows SMB Server Elevation of Privilege Vulnerability – CVE-2025-58726

A newly disclosed Windows vulnerability, CVE-2025-58726, lets attackers with low privileges gain SYSTEM-level access remotely by exploiting Kerberos authentication reflection via Ghost SPNs. Disclosed by Andrea Pierini, a researcher at Semperis, the flaw affects all Windows versions unless SMB signing is enforced and was patched by Microsoft in the October 2025 Patch Tuesday.

According to Pierini’s findings, Kerberos authentication reflection can be abused for remote privilege escalation even after fixes for related issues, with Ghost SPNs tricking Windows into authenticating to itself over SMB. The attack relies on registering a DNS record for a Ghost SPN that resolves to an attacker-controlled IP, allowing a low-privilege user to relay a Kerberos ticket back to the target and obtain full SYSTEM-level access remotely.

The exploit chain requires only a low-privilege domain user, a domain-joined target with SMB signing disabled, and the ability to configure Ghost SPNs and DNS records, with tools such as KrbRelayEx and printers/relays used to complete the escalation.