Microsoft | Breaking Cybersecurity News | The Hacker News

The disclosure of CVE-2026-25177, a high-severity privilege escalation flaw in Microsoft Active Directory Domain Services, is a timely reminder that identity infrastructure remains one of the most consequential attack surfaces in the modern enterprise. Rated HIGH with a CVSS score of 8.8, this vulnerability allows an authenticated domain user to escalate privileges and move laterally across the network without elevated starting permissions or any user interaction. The mechanics are instructive. If a compromised account holds native Active Directory (AD) permission to modify Service Principal Names (SPNs), an attacker can create a duplicate SPN for a targeted service. When clients request Kerberos authentication, the domain controller may issue a ticket encrypted with the wrong key, causing a denial of service or forcing a fallback to the weaker NTLM protocol. No access to the targeted server is required beyond that initial SPN-write permission. In an environment where Active Directo...

Many of the day-to-day digital operations of businesses, governments, and critical infrastructure have one thing in common: Microsoft. From the Microsoft Windows operating systems powering endpoints and servers, to Azure's rapidly growing cloud services, Microsoft's products are everywhere, making the company and its products attractive targets for threat actors seeking to exploit vulnerabilities at scale.  With more than 1.4 billion Windows users around the globe and the adoption of platforms like Microsoft 365, Active Directory, and Azure surging, a single exploitable vulnerability in a Microsoft product can open the door to privilege escalation, lateral movement, or ransomware deployments that impact tens of thousands of interconnected systems. Whether nation state or financially motivated, modern cyber-crime syndicates will consistently take the path of least resistance, and vulnerable assets are a reliable attack vector. For twelve years, the Microsoft Vulnerabilities Repor...

SaaS applications are the backbone of modern organizations, powering productivity and collaboration. However, they also introduce critical security risks—identity sprawl, misconfigurations, and an expanding attack surface. Identity providers have become a prime target for threat actors, prompting security teams to focus on protecting identities across multiple SaaS environments. To mitigate these risks, many organizations adopt SaaS Security Posture Management (SSPM) to harden configurations, enforce least-privilege access, and maintain visibility over human and non-human identities. SSPM is an essential preventive tool that improves cyber hygiene by reducing the attack surface. Yet prevention alone is not enough in today's evolving threat landscape. Identity Threat Detection and Response (ITDR) is crucial to bridge this gap and enable organizations to detect and respond fast to active threats targeting their identity infrastructure. The Growing Threat to SaaS Identities The rise i...