New Kerberos Relay Attack Uses DNS CNAME to Bypass Mitigations

Cybersecuritynews •Abinaya • January 19, 2026

A critical flaw in Windows Kerberos authentication that significantly expands the attack surface for credential relay attacks in Active Directory environments. By abusing how Windows clients handle DNS CNAME responses during Kerberos service ticket requests, attackers can coerce systems into requesting tickets for attacker-controlled services, bypassing traditional protections. The Attack Vector The vulnerability centers on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kerberos Relay Attack Exploits DNS CNAME Responses A new vulnerability in Windows Kerberos authentication allows attackers to exploit DNS CNAME responses to bypass existing defenses in Active Directory environments. This flaw significantly increases the attack surface for credential relay attacks, enabling systems to request tickets for services controlled by attackers. Organizations using Windows Kerberos are at risk of credential theft and unauthorized access. 2 sources 24

Extracted Entities

New Kerberos Relay Attack Uses DNS CNAME to Bypass Mitigations

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)