Researchers Release PoC for Kerberos Relay Attack via DNS CNAME Exploitation

A critical vulnerability in Windows Kerberos authentication enables attackers to conduct credential-relay attacks by manipulating DNS CNAME records, bypassing traditional security controls, and facilitating lateral movement across enterprise networks.

Tracked as CVE-2026-20929, this flaw allows threat actors to force victims to request Kerberos service tickets for attacker-controlled systems, creating avenues for exploitation even when NTLM authentication is entirely disabled.

Attack Mechanism

The vulnerability exploits how Windows Kerberos clients process DNS CNAME records during service authentication. When a system connects to a service, it performs DNS resolution.

If an attacker intercepts this query and responds with a malicious CNAME record pointing to an attacker-chosen hostname, along with an A record containing the attacker’s IP address, the Windows client constructs its Ticket Granting Service (TGS) request using the attacker’s SPN instead of the original service.

This CNAME-based method differs fundamentally from previous Kerberos relay techniques, which were limited to machine accounts or specific configurations.

The new approach grants attackers on-demand control over Service Principal Name selection across default Windows installations, including Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025.

Exploitation requires two conditions: a man-in-the-middle position for DNS traffic interception and target services accepting Kerberos authentication without enforcing message signing or Channel Binding Tokens (CBT).

Attackers can achieve network positioning through ARP poisoning, DHCPv4 poisoning to inject malicious DNS server addresses, or DHCPv6 poisoning using MITM6 techniques.

Research revealed that many Windows services accept TGS tickets based solely on the SPN’s hostname portion, regardless of the service prefix.

SMB services accept tickets with HTTP prefixes, and HTTP endpoints accept tickets with CIFS prefixes.

This cross-protocol acceptance dramatically broadens exploitation opportunities, enabling attackers to relay HTTP authentication to SMB services or target Active Directory Certificate Services web enrollment interfaces for certificate theft.

Microsoft confirmed the behavior after responsible disclosure in October 2025. Rather than modifying the CNAME-following behavior, Microsoft implemented Channel Binding Token support for HTTP.sys across supported Windows Server versions in January 2026 security updates. However, the underlying CNAME manipulation capability remains unchanged.

Security experts emphasize that Kerberos itself cannot prevent relay attacks; protection must be enforced at individual service levels.

Organizations must prioritize SMB signing enforcement, mandate CBT for all HTTP services, require LDAP signing with CBT, harden DNS infrastructure, and implement monitoring for unusual TGS requests to mitigate this critical threat.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.