CVE-2025-53779 is a zero-day privilege escalation vulnerability in Windows Kerberos, stemming from a relative path traversal issue. It was publicly disclosed and patched by Microsoft in August 2025.
This vulnerability is notable for enabling full Active Directory (AD) domain compromise via the BadSuccessor attack.
To exploit BadSuccessor, an attacker must have at least one domain controller in a domain running Windows Server 2025. Successful exploitation allows the attacker to achieve domain compromise, potentially gaining control over all domain-joined systems.
The vulnerability is particularly dangerous in hybrid environments and can be used to escalate privileges from a standard domain user to domain admin.
Microsoft released security updates for this vulnerability as part of the August 2025 Patch Tuesday. Users and administrators are strongly advised to apply the update immediately, especially in AD environments.
For systems that cannot be patched, Microsoft recommends restricting domain controller roles and monitoring for suspicious Kerberos activity.