Kerberos authentication reflection can be abused for remote privilege escalation, even after applying the fix for CVE-2025-33073.
Ghost SPNs (Service Principal Names mapped to hostnames that fail to resolve) introduce an exploitable attack surface that adversaries can leverage.
Default Active Directory (AD) settings allow standard users to register DNS records, enabling this attack, which Microsoft has cataloged as CVE‑2025‑58726 (SMB Server Elevation of Privilege).
Failure to enforce SMB signing is a critical enabler.
The attack works on all Windows versions unless SMB signing is required.
Microsoft addressed this issue in the October 2025 Patch Tuesday.