A serious security vulnerability in Windows Server 2025 allows attackers to compromise any Active Directory user, including domain administrators. Security researcher Yuval Gordon from Akamai has identified this flaw, dubbed “BadSuccessor,” which exploits the new Delegated Managed Service Account (dMSA) feature.

## The Vulnerability Explained

The attack targets dMSA, a feature introduced in Windows Server 2025 to mitigate Kerberoasting attacks. This feature allows migration from legacy service accounts by creating standalone accounts or replacing existing standard service accounts.

The critical flaw occurs during Kerberos authentication. When a dMSA supersedes an existing account:
– The Privilege Attribute Certificate (PAC) in the ticket-granting ticket includes both the dMSA’s security identifier (SID) and the SIDs of the superseded account
– This permissions transfer creates a privilege escalation opportunity
– Attackers can simulate the dMSA migration process to gain privileges similar to any user, including domain administrators

“One interesting fact about this ‘simulated migration’ technique is that it doesn’t require any permissions over the superseded account,” Gordon explained. “The only requirement is write permissions over the attributes of a dMSA.”

## Impact and Prevalence

The vulnerability affects most organizations relying on Active Directory. Akamai’s research found that in 91% of examined environments, users outside the domain admins group had sufficient permissions to execute this attack.

What makes this attack particularly concerning is that it works:
– With default configurations
– Even in environments not actively using dMSAs
– Without requiring permissions over the targeted account

## Microsoft’s Response

Akamai reported the findings to Microsoft on April 1, 2025. Microsoft classified the issue as moderate severity, stating it doesn’t warrant immediate servicing since exploitation requires specific permissions on the dMSA object. However, a patch is currently in development.

## Mitigation Recommendations

Until a patch is available, organizations should:
– Limit the ability to create dMSAs
– Harden permissions where possible
– Use Akamai’s released PowerShell script to identify non-default principals who can create dMSAs and list organizational units where each principal has this permission

Gordon warns that “this vulnerability introduces a previously unknown and high-impact abuse path” comparable to the Replicating Directory Changes privilege used in DCSync attacks.