New Kerberos Relay Attack Uses DNS CNAME to Bypass Mitigations – PoC Released

A critical Kerberos authentication weakness allows an on-path attacker to use DNS CNAME coercion to make Windows clients request service tickets for attacker-controlled SPNs, enabling credential relay attacks (including HTTP→SMB and HTTP→LDAP), lateral movement, impersonation, and potential RCE via ADCS Web Enrollment (ESC8). Researchers published a MITM6-based PoC with CNAME poisoning; Microsoft patched HTTP.sys (CVE-2026-20929) to mitigate HTTP relays, but the fundamental CNAME coercion primitive remains, leaving other protocols at risk. Organizations are advised to enforce SMB/LDAP signing, require Channel Binding Tokens and HTTPS with CBT, harden DNS infrastructure, and monitor anomalous TGS requests.