Active-Directory — PoC Archivehttps://poc.intelseclab.com/tags/active-directory/Latest proof-of-concept entries.Hugoen-usTue, 11 Aug 2026 00:00:00 +0000Windows Kerberos — ResetNightmare: Arbitrary Password Reset via Change Password Protocol Validation Flaw (CVE-2026-27912)https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/High severity (CVSS 8) — network · CVE-2026-27912. Status: Patched. Affects: Microsoft Windows Kerberos Key Distribution Center (KDC), Change Password protocol (kadmin/changepw). Tags: windows, kerberos, active-directory, privilege-escalation, password-reset, domain-controller, upn, rubeus, changepw, krbtgt, CWE-285, microsoft, CVE-2026-27912.networkHighwindowskerberosactive-directoryprivilege-escalationpassword-resetdomain-controllerupnrubeuschangepwkrbtgtCWE-285microsoftCVE-2026-27912Active Directory — SPN Unicode Collision Detection Scanner (CVE-2026-25177)https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-25177-ad-spn-unicode-collision-detector/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-25177-ad-spn-unicode-collision-detector/High severity (CVSS 8.8) — network · CVE-2026-25177. Status: Patched. Affects: Microsoft Active Directory Domain Services, Service Principal Name (SPN) validation. Tags: windows, active-directory, kerberos, spn, unicode, homoglyph, privilege-escalation, detection, scanner, ldap, CWE-641, microsoft, CVE-2026-25177.networkHighwindowsactive-directorykerberosspnunicodehomoglyphprivilege-escalationdetectionscannerldapCWE-641microsoftCVE-2026-25177AD CS/AD FS Enrollment "cdc" Chase Attribute Abuse → Domain Controller Impersonation (CertiGhost, CVE-2026-54121)https://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54121-certighost-adcs-dc-impersonation/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54121-certighost-adcs-dc-impersonation/High severity (CVSS 8.8) — network · CVE-2026-54121. Status: Weaponized. Affects: Microsoft Active Directory Certificate Services (AD CS) Enterprise CA, in environments where AD FS / certificate enrollment resolves DC identity via "chase" (cdc/rmd) request attributes. Tags: active-directory, adcs, certificate-services, dcsync, pkinit, kerberos, privilege-escalation, domain-controller-impersonation, windows.networkHighactive-directoryadcscertificate-servicesdcsyncpkinitkerberosprivilege-escalationdomain-controller-impersonationwindowsWindows Kerberos Reflection via Unicode SPN Normalization Bypass (CVE-2026-26128)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-26128-adcs-kerberos-relay-unicode-spn/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-26128-adcs-kerberos-relay-unicode-spn/Critical severity — network · CVE-2026-26128. Status: Weaponized. Affects: Windows Active Directory (DnsCache SPN resolution / Kerberos authentication). Tags: kerberos-relay, active-directory, adcs, unicode-normalization, spn-spoofing, ntlm-relay, dns-spoofing, privilege-escalation.networkCriticalkerberos-relayactive-directoryadcsunicode-normalizationspn-spoofingntlm-relaydns-spoofingprivilege-escalationVMware ESXi Active Directory Authentication Bypass (CVE-2024-37085)https://poc.intelseclab.com/pocs/network/2026-05-16_vmware-esxi-ad-auth-bypass/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-16_vmware-esxi-ad-auth-bypass/Medium severity (CVSS 6.8) — network · CVE-2024-37085. Status: Weaponized. Affects: VMware ESXi hosts joined to Microsoft Active Directory. Tags: auth-bypass, Active Directory, ESXi, vCenter, ransomware, unauthenticated-esxi.networkMediumauth-bypassActive DirectoryESXivCenterransomwareunauthenticated-esxi