{"id":27808,"date":"2025-07-09T20:56:12","date_gmt":"2025-07-09T18:56:12","guid":{"rendered":"https:\/\/perseus.de\/critical-vulnerability-in-windows-authentication\/"},"modified":"2026-03-31T07:17:17","modified_gmt":"2026-03-31T05:17:17","slug":"critical-vulnerability-in-windows-authentication","status":"publish","type":"post","link":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/","title":{"rendered":"Critical vulnerability in Windows authentication"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"27808\" class=\"elementor elementor-27808 elementor-24082\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dcf4ec4 e-flex e-con-boxed e-con e-parent\" data-id=\"dcf4ec4\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e1db58c elementor-widget elementor-widget-image\" data-id=\"e1db58c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"800\" height=\"200\" src=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\" class=\"attachment-large size-large wp-image-27799\" alt=\"\" srcset=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png 1024w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-300x75.png 300w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-768x192.png 768w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025.png 1200w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1258a43 e-flex e-con-boxed e-con e-parent\" data-id=\"1258a43\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-2de4e88 e-con-full e-flex e-con e-child\" data-id=\"2de4e88\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4982c80 elementor-widget elementor-widget-text-editor\" data-id=\"4982c80\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h6>09.07.2025<\/h6>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8348bc5 elementor-widget elementor-widget-heading\" data-id=\"8348bc5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Critical vulnerability in Windows authentication<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-eb03842 e-con-full e-flex e-con e-child\" data-id=\"eb03842\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-91d0988 elementor-widget elementor-widget-text-editor\" data-id=\"91d0988\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>We would like to draw your attention to a critical security vulnerability in Microsoft Windows that currently poses an acute risk to your IT infrastructure. The vulnerability with a <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-47981\" target=\"_blank\" rel=\"noopener noreferrer\" data-saferedirecturl=\"https:\/\/www.google.com\/url?q=https:\/\/www.cve.org\/CVERecord?id%3DCVE-2025-47981&amp;source=gmail&amp;ust=1752172609247000&amp;usg=AOvVaw1EVpGsepX1LbdrdUsJeWN-\">CVSS score of 9.8<\/a> affects almost all current Windows and Windows Server versions \u2013 including Windows Server 2008 R2 \u2013 and allows attackers to execute malicious code with system privileges without user interaction. <\/p><p> <\/p><p>Immediate patching of affected systems is urgently needed.<\/p><p data-start=\"79\" data-end=\"370\"><span style=\"font-weight: 400;\">IT security researchers report <\/span><b>active attacks<\/b> <span style=\"font-weight: 400;\">in which, among other things, existing web sessions were compromised and authentications were obtained without the knowledge of the users \u2013 <\/span><b>suggesting that active multi-factor authentication could also be bypassed<\/b><span style=\"font-weight: 400;\">.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-ceb0f40 e-flex e-con-boxed e-con e-parent\" data-id=\"ceb0f40\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ffbdc12 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"ffbdc12\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-02dd0e9 e-flex e-con-boxed e-con e-parent\" data-id=\"02dd0e9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-16d621d e-con-full e-flex e-con e-child\" data-id=\"16d621d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-89904c7 elementor-widget elementor-widget-text-editor\" data-id=\"89904c7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>What happened?<\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-fae461d e-con-full e-flex e-con e-child\" data-id=\"fae461d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-0f04793 elementor-widget elementor-widget-text-editor\" data-id=\"0f04793\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Microsoft has identified and published <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-47981\" target=\"_blank\" rel=\"noopener noreferrer\" data-saferedirecturl=\"https:\/\/www.google.com\/url?q=https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-47981&amp;source=gmail&amp;ust=1752172609247000&amp;usg=AOvVaw1dZenBlzfToAEFIsbiHtGf\">a serious vulnerability<\/a> (<a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-47981\" target=\"_blank\" rel=\"noopener noreferrer\" data-saferedirecturl=\"https:\/\/www.google.com\/url?q=https:\/\/www.cve.org\/CVERecord?id%3DCVE-2025-47981&amp;source=gmail&amp;ust=1752172609247000&amp;usg=AOvVaw1EVpGsepX1LbdrdUsJeWN-\">CVE-2025-47981<\/a>) in the SPNEGO NEGOEX authentication protocol &#8211; an important part of Windows authentication in the domain environment, among other things. This vulnerability allows attackers to execute arbitrary code with system privileges \u2013 without logging in and without any user action.  <\/p><p> <\/p><p>The threat is particularly serious because <a href=\"https:\/\/www.helpnetsecurity.com\/2025\/07\/09\/microsoft-fixes-critical-wormable-windows-flaw-cve-2025-47981\/\" target=\"_blank\" rel=\"noopener noreferrer\" data-saferedirecturl=\"https:\/\/www.google.com\/url?q=https:\/\/www.helpnetsecurity.com\/2025\/07\/09\/microsoft-fixes-critical-wormable-windows-flaw-cve-2025-47981\/&amp;source=gmail&amp;ust=1752172609247000&amp;usg=AOvVaw0vza0C3UJT_6jqm3bZ7UNG\">Microsoft classifies it as &#8220;wormable&#8221;.<\/a> This means that the malware can spread automatically via networks. According to Microsoft, a first abuse of this vulnerability is expected shortly.  <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-cdadbd8 e-flex e-con-boxed e-con e-parent\" data-id=\"cdadbd8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-104dd95 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"104dd95\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-71fc1cf e-con-full e-flex e-con e-child\" data-id=\"71fc1cf\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-ca1a3f3 e-con-full e-flex e-con e-child\" data-id=\"ca1a3f3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-66292b3 e-con-full e-flex e-con e-child\" data-id=\"66292b3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9745167 elementor-widget elementor-widget-text-editor\" data-id=\"9745167\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Reported vulnerability<br><br><\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-35b99f8 e-con-full e-flex e-con e-child\" data-id=\"35b99f8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b163873 elementor-widget elementor-widget-text-editor\" data-id=\"b163873\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The vulnerability allows unauthenticated attackers to execute code with system privileges through crafted NETWORK messages, triggering a &#8220;heap-based buffer overflow&#8221;. This is a bug in the handling of memory. When they are executed, programs reserve space in the so-called heap \u2013 a dynamic memory area that is flexibly requested at runtime.  <\/p><p>If more is written in this area than is intended, neighboring memory areas can be manipulated. This allows attackers to inject and execute their own malicious code \u2013 in this case, even with the highest privileges. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4dfc5b9 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"4dfc5b9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-174b215 e-flex e-con-boxed e-con e-parent\" data-id=\"174b215\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-e560a6b e-con-full e-flex e-con e-child\" data-id=\"e560a6b\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-013b67e elementor-widget elementor-widget-text-editor\" data-id=\"013b67e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>What is affected?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a72ed48 e-con-full e-flex e-con e-child\" data-id=\"a72ed48\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-db8754f elementor-widget elementor-widget-text-editor\" data-id=\"db8754f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>This vulnerability affects <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-47981\" target=\"_blank\" rel=\"noopener noreferrer\" data-saferedirecturl=\"https:\/\/www.google.com\/url?q=https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-47981&amp;source=gmail&amp;ust=1752172609247000&amp;usg=AOvVaw1dZenBlzfToAEFIsbiHtGf\">all Windows clients starting with Windows 10 version 1607<\/a> because these versions have the following Group Policy enabled by default: &#8220;Network Security: Allow PKU2U<wbr><\/wbr> authentication requests<wbr><\/wbr>to this computer with online identities&#8221;.<\/p><p>This default setting means that the attack surface is already active on many systems \u2013 even without any special configuration.<\/p><p> <\/p><p>Systems in which NEGOEX is used in combination with the following services are also particularly at risk:<\/p><ul><li>Active Directory \/ Domain Controller<\/li><li>RDP Accesses<\/li><li>VPN Gateways<\/li><li>SMB File Shares<\/li><li>Windows Remote Management (WinRM)<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-da9fcac e-flex e-con-boxed e-con e-parent\" data-id=\"da9fcac\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-70aad00 e-con-full e-flex e-con e-child\" data-id=\"70aad00\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-55be951 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"55be951\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d3f9227 e-flex e-con-boxed e-con e-parent\" data-id=\"d3f9227\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-6059711 e-con-full e-flex e-con e-child\" data-id=\"6059711\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-26eea72 elementor-widget elementor-widget-text-editor\" data-id=\"26eea72\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>What can I do?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-724b6c6 e-con-full e-flex e-con e-child\" data-id=\"724b6c6\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f0c2fb4 elementor-widget elementor-widget-text-editor\" data-id=\"f0c2fb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The CVE-2025-47981 vulnerability poses an acute threat to Windows-based networks. The combination of high criticality, ease of exploitation, and the possibility of automatic distribution makes this vulnerability particularly dangerous. <\/p><p>We recommend that you <a href=\"https:\/\/www.cyberdaily.au\/security\/12350-experts-concerned-over-newly-disclosed-critical-windows-vulnerability?\" target=\"_blank\" rel=\"noopener noreferrer\" data-saferedirecturl=\"https:\/\/www.google.com\/url?q=https:\/\/www.cyberdaily.au\/security\/12350-experts-concerned-over-newly-disclosed-critical-windows-vulnerability?&amp;source=gmail&amp;ust=1752172609247000&amp;usg=AOvVaw05HHPnlNVh3IxPBNYDeJp8\">act immediately to prevent potential harm<\/a>:<\/p><p> <\/p><ol><li>Priority: Install the latest Microsoft security updates immediately, especially on publicly accessible or business-critical systems.<\/li><li>If you are unable to patch, block network access to ports 135, 445, and 5985 if technically possible.<\/li><li>Use Group Policy (GPO) to disable the &#8220;Allow PKU2U authentication requests&#8221; setting if not needed.<\/li><li>Check which systems are potentially vulnerable and prioritize securing sensitive services such as AD, RDP, or VPN.<\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-65d84f2 e-flex e-con-boxed e-con e-parent\" data-id=\"65d84f2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-3c936a5 e-con-full e-flex e-con e-child\" data-id=\"3c936a5\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3bbb54c elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"3bbb54c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-36d5f66 e-flex e-con-boxed e-con e-parent\" data-id=\"36d5f66\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-60eb6a0 elementor-widget elementor-widget-heading\" data-id=\"60eb6a0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">From experts for experts:<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-092ac14 elementor-widget elementor-widget-text-editor\" data-id=\"092ac14\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>Important note: Please note that blocking ports 135, 445 and 5985 may result in the following effects:<\/strong><\/p><p> <\/p><ul><li>File shares (network drives): These may no longer be accessible.<\/li><li>Group Policy: GPOs can fail or be delayed depending on the environment.  <\/li><li>Remote PowerShell (WinRM): Script-based solutions such as SCCM, Ansible, or other automation tools may no longer work.<\/li><li>MI\/DCOM access: Tools for monitoring, inventory, or administration can be disrupted, e.g. when connecting to remote systems.<\/li><\/ul><p> <\/p><p>Here&#8217;s how you can identify a potential exploitation of the vulnerability:<\/p><p> <\/p><ul><li>Use EDR\/antivirus with memory analysis (e.g. Defender for Endpoint, CrowdStrike, SentinelOne) to detect suspicious activity in memory.<\/li><li>Enable event log monitoring \u2013 pay special attention to LSASS crashes and unusual network connections.<\/li><li>Use Sysmon (especially the events: ID 1: Process start, ID 10: Access to other processes, ID 11: File operations)<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-dcff67d e-flex e-con-boxed e-con e-parent\" data-id=\"dcff67d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-ad15629 e-con-full e-flex e-con e-child\" data-id=\"ad15629\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dd3e115 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"dd3e115\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>There is a critical vulnerability in Microsoft Windows (CVSS 9.8) that affects almost all current Windows and server versions and allows attackers to execute malicious code with system privileges without user interaction \u2013 an acute risk to your IT infrastructure<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[64],"tags":[],"class_list":["post-27808","post","type-post","status-publish","format-standard","hentry","category-hazard-warning"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Critical vulnerability in Windows authentication - Perseus Technologies<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Critical vulnerability in Windows authentication - Perseus Technologies\" \/>\n<meta property=\"og:description\" content=\"There is a critical vulnerability in Microsoft Windows (CVSS 9.8) that affects almost all current Windows and server versions and allows attackers to execute malicious code with system privileges without user interaction \u2013 an acute risk to your IT infrastructure\" \/>\n<meta property=\"og:url\" content=\"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/\" \/>\n<meta property=\"og:site_name\" content=\"Perseus Technologies\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-09T18:56:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-31T05:17:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Xenia Silbe\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xenia Silbe\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/\"},\"author\":{\"name\":\"Xenia Silbe\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/person\\\/42cdb0ff9720a4c92a2613f686b32f46\"},\"headline\":\"Critical vulnerability in Windows authentication\",\"datePublished\":\"2025-07-09T18:56:12+00:00\",\"dateModified\":\"2026-03-31T05:17:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/\"},\"wordCount\":614,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\",\"articleSection\":[\"Hazard warning\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/\",\"url\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/\",\"name\":\"Critical vulnerability in Windows authentication - Perseus Technologies\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\",\"datePublished\":\"2025-07-09T18:56:12+00:00\",\"dateModified\":\"2026-03-31T05:17:17+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/#primaryimage\",\"url\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\",\"contentUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-windows-authentication\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/perseus.de\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Critical vulnerability in Windows authentication\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#website\",\"url\":\"https:\\\/\\\/perseus.de\\\/\",\"name\":\"perseus-web.de\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/perseus.de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#organization\",\"name\":\"perseus-web.de\",\"url\":\"https:\\\/\\\/perseus.de\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/PerseusTechnologie_Color-2.png\",\"contentUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/PerseusTechnologie_Color-2.png\",\"width\":536,\"height\":172,\"caption\":\"perseus-web.de\"},\"image\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/person\\\/42cdb0ff9720a4c92a2613f686b32f46\",\"name\":\"Xenia Silbe\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g\",\"caption\":\"Xenia Silbe\"},\"sameAs\":[\"https:\\\/\\\/perseus.de\\\/\"],\"url\":\"https:\\\/\\\/perseus.de\\\/en\\\/author\\\/xenia-silbe\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Critical vulnerability in Windows authentication - Perseus Technologies","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/","og_locale":"en_US","og_type":"article","og_title":"Critical vulnerability in Windows authentication - Perseus Technologies","og_description":"There is a critical vulnerability in Microsoft Windows (CVSS 9.8) that affects almost all current Windows and server versions and allows attackers to execute malicious code with system privileges without user interaction \u2013 an acute risk to your IT infrastructure","og_url":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/","og_site_name":"Perseus Technologies","article_published_time":"2025-07-09T18:56:12+00:00","article_modified_time":"2026-03-31T05:17:17+00:00","og_image":[{"width":1200,"height":300,"url":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025.png","type":"image\/png"}],"author":"Xenia Silbe","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Xenia Silbe","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/#article","isPartOf":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/"},"author":{"name":"Xenia Silbe","@id":"https:\/\/perseus.de\/#\/schema\/person\/42cdb0ff9720a4c92a2613f686b32f46"},"headline":"Critical vulnerability in Windows authentication","datePublished":"2025-07-09T18:56:12+00:00","dateModified":"2026-03-31T05:17:17+00:00","mainEntityOfPage":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/"},"wordCount":614,"commentCount":0,"publisher":{"@id":"https:\/\/perseus.de\/#organization"},"image":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/#primaryimage"},"thumbnailUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png","articleSection":["Hazard warning"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/","url":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/","name":"Critical vulnerability in Windows authentication - Perseus Technologies","isPartOf":{"@id":"https:\/\/perseus.de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/#primaryimage"},"image":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/#primaryimage"},"thumbnailUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png","datePublished":"2025-07-09T18:56:12+00:00","dateModified":"2026-03-31T05:17:17+00:00","breadcrumb":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/#primaryimage","url":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png","contentUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png"},{"@type":"BreadcrumbList","@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-windows-authentication\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/perseus.de\/"},{"@type":"ListItem","position":2,"name":"Critical vulnerability in Windows authentication"}]},{"@type":"WebSite","@id":"https:\/\/perseus.de\/#website","url":"https:\/\/perseus.de\/","name":"perseus-web.de","description":"","publisher":{"@id":"https:\/\/perseus.de\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/perseus.de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/perseus.de\/#organization","name":"perseus-web.de","url":"https:\/\/perseus.de\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/perseus.de\/#\/schema\/logo\/image\/","url":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/03\/PerseusTechnologie_Color-2.png","contentUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/03\/PerseusTechnologie_Color-2.png","width":536,"height":172,"caption":"perseus-web.de"},"image":{"@id":"https:\/\/perseus.de\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/perseus.de\/#\/schema\/person\/42cdb0ff9720a4c92a2613f686b32f46","name":"Xenia Silbe","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g","caption":"Xenia Silbe"},"sameAs":["https:\/\/perseus.de\/"],"url":"https:\/\/perseus.de\/en\/author\/xenia-silbe\/"}]}},"_links":{"self":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts\/27808","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/comments?post=27808"}],"version-history":[{"count":1,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts\/27808\/revisions"}],"predecessor-version":[{"id":27809,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts\/27808\/revisions\/27809"}],"wp:attachment":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/media?parent=27808"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/categories?post=27808"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/tags?post=27808"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}