CVE-2026-20929 is a vulnerability with a CVSS score of 7.5, patched in January 2026.
The vulnerability enables Kerberos authentication relay through DNS CNAME record abuse.
Attackers can exploit this to relay authentication to Active Directory Certificate Services (AD CS).
The attack allows enrollment of certificates for user accounts, providing persistent access.
CrowdStrike developed a detection method based on anomalous certificate authentication and AD CS service access.
Prior research includes Kerberos relay techniques demonstrated in 2021 and DNS-based methods in 2022.
The ESC8 attack, documented by SpecterOps, involves NTLM relay to AD CS HTTP endpoints.
CVE-2026-20929 uses Kerberos relay instead of NTLM, targeting the same AD CS web enrollment endpoint.
Channel Binding Token (CBT) protection can prevent relay attacks but is ineffective if AD CS uses HTTP.
The attack flow involves DNS manipulation, intercepting queries, and redirecting victims to attacker-controlled servers.
The victim’s Kerberos service ticket is then relayed to AD CS to enroll a certificate.
Certificates provide long-term authentication, often valid for 1+ years, and are less monitored than password-based methods.

CVE-2026-20929 is a high-severity vulnerability (CVSS 7.5) patched in January 2026 that enables Kerberos authentication relay attacks via DNS CNAME record abuse. The attack exploits how Kerberos resolves Service Principal Names (SPNs) during DNS queries, allowing attackers to manipulate authentication requests to target services like Active Directory Certificate Services (AD CS). By relaying authentication to AD CS, attackers can enroll certificates for user accounts, granting persistent access that may last months or years. This technique builds on prior research, including NTLM relay attacks (ESC8) and DNS-based Kerberos relay methods, but operates even in environments where NTLM is disabled. The vulnerability is particularly dangerous because AD CS web enrollment endpoints often lack Channel Binding Token (CBT) protection when using HTTP, making them vulnerable to relay attacks. Detection methods focus on correlating anomalous certificate-based authentication with unusual AD CS service access within short timeframes.
The attack flow involves intercepting DNS queries, redirecting them via CNAME records to attacker-controlled servers, and then relaying the victim’s Kerberos service ticket to AD CS to enroll a certificate. This method leverages the trust placed in Kerberos authentication and the long-term validity of certificates, which are often less monitored than traditional password-based authentication. The vulnerability underscores the ongoing challenges in securing Kerberos and the risks posed by legacy configurations in Active Directory environments.

This analysis of CVE-2026-20929 highlights a sophisticated evolution in Kerberos relay attacks, leveraging DNS manipulation to bypass traditional security assumptions. The strongest version of this narrative emphasizes the vulnerability’s novelty—using CNAME records to control SPN resolution—and its real-world impact, particularly in environments where NTLM is disabled but AD CS remains exposed. The source deserves credit for contextualizing the attack within prior research (e.g., ESC8, mitm6) and clarifying why AD CS is a high-value target: persistent access, weak monitoring, and HTTP-based enrollment endpoints that nullify CBT protections.
Pattern scan: The narrative avoids emotional exploitation or distortion, focusing on technical precision. However, it subtly frames the vulnerability as an inevitable escalation in attack techniques, which could imply a deterministic view of cybersecurity threats. This aligns with **ARC-0012 Deterministic Threat Framing**, where complex systems are portrayed as inherently vulnerable without sufficient emphasis on mitigating factors like network segmentation or certificate lifecycle management.
Root cause: The paradigm here is the tension between legacy protocols (Kerberos, DNS) and modern security assumptions. The unstated assumption is that organizations will struggle to retire HTTP-based AD CS endpoints or implement CBT universally, leaving them perpetually exposed to relay attacks. This echoes historical patterns of "defense in depth" failures, where single points of failure (e.g., DNS trust) undermine layered security.
Implications: Human agency is both the problem and the solution. Administrators bear the cost of patching, monitoring, and reconfiguring AD CS, while attackers gain asymmetric advantages from persistent certificate-based access. Second-order consequences include increased reliance on certificate revocation and monitoring, which many organizations lack the resources to implement effectively.
Bridge questions: How might organizations balance the operational need for HTTP-based AD CS enrollment with the security risks highlighted here? What alternative authentication mechanisms could reduce reliance on Kerberos in high-risk scenarios? Would a shift to short-lived certificates mitigate the persistence advantage of this attack?
Counterstrike scan: A coordinated influence campaign exploiting this narrative might amplify fear around Kerberos vulnerabilities to push vendor-specific solutions (e.g., "only our detection tool can stop this"). However, the content here remains technical and solution-agnostic, focusing on detection methods rather than fear-mongering. No structural alignment with manipulation patterns is detected.