BadSuccessor (CVE-2025-53779) Technique Persists Despite Microsoft Patch

At DEF CON 2025, Akamai security researcher Yuval Gordon revealed BadSuccessor (CVE-2025-53779), an Active Directory vulnerability in Windows Server 2025’s delegated Managed Service Account feature that allowed a low-privileged user to escalate directly to Domain Admin. Before Microsoft’s patch, the flaw exploited how AD handled dMSA objects, with the Key Distribution Center treating the dMSA as the successor during authentication.

Microsoft assigned CVE-2025-53779 and released a patch less than a week after disclosure, and Akamai researchers tested the fix, noting that the write attribute could still be altered but the KDC would not issue a ticket when the dMSA attempted to inherit the target’s privileges and keys. The patch hardened kdcsvc.dll so the KDC validates a true mutual pairing, meaning the only way to obtain a valid ticket was to make the link mutual.

Despite the patch, Akamai stresses that the underlying technique persists as a method, with two exploitation primitives remaining: credential acquisition via linking a controlled dMSA to a target, and targeted credential dumps in compromised domains without DCSync. Akamai recommends patching, auditing dMSA creation and link changes, watching for behavioural tells, and tightening delegations to limit who can create or modify dMSAs.