Reflecting on Your Tier Model: CVE-2025-33073 and the One-Hop Problem

Critical vulnerability CVE-2025-33073 enables abuse of unconstrained Kerberos delegation: any domain user with network access can obtain SYSTEM on unpatched member servers that lack SMB signing, making domain compromise trivial. The report urges immediate patching and prioritization of systems with unconstrained delegation, enabling SMB signing, marking privileged accounts as "sensitive and cannot be delegated" and adding them to Protected Users, running LSASS as a Protected Process Light, and monitoring for distinctive DNS record creation and self-authenticating SMB sessions for detection.