New Attack Chains Ghost SPNs and Kerberos Reflection to Elevate SMB Privileges

Ghost SPNs and Kerberos reflection are described as a new attack chain that enables a domain user to achieve SYSTEM-level access on a Windows domain joined machine, even where prior Kerberos mitigations exist. The issue, tracked as CVE-2025-58726, is a SMB Server Elevation of Privilege vulnerability with a CVSS score of 8.8 and a network attack vector, and Microsoft has addressed it in October 2025 patches.

The technique relies on misconfigured SPNs referencing hostnames that don’t resolve in DNS, paired with Kerberos reflection to trap authentication requests and redirect them to attacker-controlled endpoints. The article notes several required conditions for exploitation, including absence of enforced SMB signing and the ability for a domain user to register DNS records, with potential escalation to complete domain compromise if a Tier 0 asset, such as an Active Directory Certificate Services server, is affected.

Mitigations include applying October 2025 security updates, enforcing SMB signing across domain machines, auditing and removing misconfigured SPNs, restricting DNS write permissions for standard users, and monitoring Kerberos traffic for suspicious tickets, alongside disabling unnecessary RPC services. According to Microsoft, the patch modifies the SMB driver to detect and terminate non-local Kerberos reflection attempts.