CVE-2026-65777: Active Directory Cross-Realm Security Feature Bypass

HERMES

HERMES THREAT SCORE & TRUST BOUNDARY COMPROMISE

Target: Active Directory Trust Validation Subsystem (kdc.dll / lsass.exe)

Confidence: 93%

86 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 17 / 20

Threat Activity 15 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 18 / 20

Impact 19 / 20

Exploit Maturity 16 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-65777 at 5.3 (MEDIUM, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). The Hermes Threat Score elevates operational risk to 86 (HIGH) because bypassing SID filtering across forest trusts breaks the foundational multi-domain isolation guarantee of Active Directory.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-65777: Active Directory Cross-Realm Security Feature BypassVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Trust Boundary Vulnerability Alert: Cross-Forest Security Bypass

CVSS v3.1 : 5.3 MEDIUM (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) / CWE-326: Inadequate Encryption Strength / Improper Verification. Resolved in the August 2026 Microsoft security updates affecting Windows Server Domain Controllers managing forest and external trusts.

Executive Summary

CVE-2026-65777 is an Active Directory security feature bypass vulnerability affecting cross-realm Kerberos referrals and inter-forest trust evaluation. An attacker possessing administrative control over a trusted domain in Forest A can construct Kerberos tickets with specially crafted SID history and Name Suffix routing attributes that bypass SID filtering rules on the Domain Controllers of trusting Forest B, achieving unauthorized administrative privileges in the target forest.

---

1. Technical Context & Affected Software Matrix

Active Directory forest trusts rely on SID filtering and Name Suffix Routing (NSR) to prevent an administrator of a compromised domain from spoofing security identifiers belonging to another domain.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-65777	MSRC Bulletin August 2026
Vulnerable Component	Windows KDC Trust Verifier (kdc.dll / kerberos.dll)	Active Directory cross-forest authentication subsystem
CWE Weakness	CWE-326: Inadequate Encryption Strength / Verification Bypass	Flawed validation in inter-realm PAC verification
CVSS v3.1 Score	5.3 (MEDIUM / Hermes Operational Severity 86)	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Pre-requisites	Compromise of a trusted domain or child domain	Pivot across Active Directory trust boundaries
Affected Platforms	Windows Server 2019, Windows Server 2022, Windows Server 2025	All Domain Controllers evaluating cross-forest tickets
Microsoft Patches	Cumulative Updates August 2026 (KB5041578, KB5041585, KB5041592)	Mandatory on forest root DCs

---

2. In-Depth Technical Decomposition & Root Cause

When a Kerberos cross-realm ticket-granting ticket (referral TGT) traverses an inter-forest trust, the KDC of the resource domain executes the KdcVerifyPac and KdcFilterSids subroutines to purge disallowed SIDs (e.g., Enterprise Admins S-1-5-21-...-519 or Schema Admins).

In CVE-2026-65777, the KDC fails to parse alternate SID encoding structures when multiple sub-authorities are packed using non-canonical ASN.1 integer lengths in the Kerberos referral request:

// Conceptual depiction of CVE-2026-65777 SID filtering evasion
BOOLEAN KdcFilterSidsNonCanonical(
    PPACTYPE pPac,
    PUNICODE_STRING pTrustPartnerDomain,
    ULONG TrustAttributes
) {
    for (ULONG i = 0; i < pPac->ExtraSidsCount; i++) {
        PSID pCurrentSid = pPac->ExtraSids[i].Sid;

        // VULNERABILITY: If the SID header contains non-canonical zero padding
        // or alternate sub-authority count representations,
        // RtlValidSid returns TRUE but RtlEqualPrefixSid fails to match the blacklisted domain prefix!
        if (IsDisallowedSidPrefix(pCurrentSid)) {
            RemoveSidFromPac(pPac, i);
        }
        // Result: Privileged foreign SIDs (e.g. Enterprise Admins) bypass the filter and persist in the token!
    }
    return TRUE;
}

Because the blacklisted prefix check misses the non-canonically formatted SID, the resource KDC accepts the referral ticket and mints a local service ticket containing privileged group memberships in Forest B.

---

3. Attack Vectors & Enterprise Threat Scenarios

[ Attacker with Domain Admin in Domain A (Forest A) ]
               │
               ▼ (Forge Kerberos Referral TGT with Non-Canonical ExtraSids)
[ Active Directory Inter-Forest Trust Boundary ]
               │
               ▼ (CVE-2026-65777 SID Filtering Bypass in kdc.dll)
[ Resource Domain Controller in Forest B accepts Enterprise Admin SID ]
               │
               ▼ (Local Service Ticket issued with privileged PAC)
[ Unauthorized Forest Compromise of Forest B ]

Forensic Correlation with Active Directory Corpus

• SID Filtering and Name Suffix Routing: The exact mechanics of SID quarantine and how inter-forest trusts defend against SID injection. See AD-17: SID filtering and Name Suffix Routing.
• Active Directory Trust Fundamentals: Understanding one-way, two-way, and transitivity in trust relationships. See AD-13: Active Directory trust fundamentals.
• What an Attacker Controlling Domain A Can Do to Domain B: The operational implications of trust compromise. See AD-19: What an attacker controlling Domain A can do to Domain B.

---

4. Forensic Detection, Artefacts & Event IDs

Detecting CVE-2026-65777 exploitation centers on Kerberos cross-realm ticket requests and unusual Foreign Security Principal creations:

Essential Artefacts & Event IDs

• Security Event ID 4769 (Kerberos Service Ticket Operations): Look for ServiceName starting with krbtgt/ from external domains where the client SID belongs to a foreign namespace.
• Security Event ID 4624: Type 3 network logons with Authentication Package: Kerberos where the token contains high-privilege RIDs (-500, -512, -519) from a foreign trust.
• Security Event ID 4768: Anomalous TGT issuance across trust boundaries without corresponding Netlogon validation logs.

KQL Query: Detecting Filtered SIDs in Cross-Realm Logons

SecurityEvent
| where EventID == 4624
| extend TargetSid = tostring(parse_json(EventData).TargetUserSid)
| extend LogonProcessName = tostring(parse_json(EventData).LogonProcessName)
| where LogonProcessName =~ "Kerberos"
| where TargetSid endswith "-519" or TargetSid endswith "-512" // Enterprise/Domain Admins
| where WorkstationName != "" and WorkstationName !startswith "CORP-"
| project TimeGenerated, TargetUserName, TargetSid, IpAddress, WorkstationName

---

5. Remediation, Hardening & Defensive Engineering

1. Deploy Microsoft Updates: Apply KB5041578 / KB5041585 across all Domain Controllers in all interconnected forests.
2. Enforce SID Filtering Quarantine: Verify SID filtering status using netdom trust <TrustingDomain> /domain:<TrustedDomain> /enablesidhistory:no and netdom trust ... /quarantine:yes.
3. Migrate to Selective Authentication: Disable forest-wide authentication across external trusts, requiring explicit ACL grants for incoming users.