Active Directory Attacks in 2026: What Testers Check

A domain controller holds every account, every group and the keys that prove who a user is. An attacker who reaches it can read email, open file servers, reset passwords and disable security tools. CrowdStrike's 2026 Global Threat Report puts the average time between initial access and lateral movement for criminal groups at 29 minutes, so the path from a first foothold to administrator access has to be short for defenders to stop it.

Most Active Directory compromises in assessments do not need a new vulnerability. They chain ordinary weaknesses:

• Kerberoasting. Any user can request service tickets for accounts with a service principal name and crack the password offline. Service accounts with weak passwords and old settings are the usual prize.
• AS-REP roasting. Accounts that do not require Kerberos pre-authentication can be attacked the same way.
• Password spraying. One common password tried against every account, slowly enough to avoid lockout.
• Delegation and permission abuse. Unconstrained delegation, over-broad rights on user and group objects and nested groups give a path that BloodHound can map from a low-privilege user to Domain Admins.
• Credential reuse. A local administrator password that is the same on every workstation turns one machine into all of them.

Many organizations run a certificate authority and forget it. Certificate templates that allow a requester to name any subject, weak permissions on templates or the authority itself, and enrollment endpoints that accept relayed authentication have all led to domain compromise. A certificate also stays valid after a password reset, so a stolen one can outlast a clean-up. Testers check templates, enrollment permissions and the authority's own settings, and the fix is usually configuration, not software.

In May 2025 researchers at Akamai described BadSuccessor, an escalation path in Windows Server 2025's delegated Managed Service Accounts (dMSA). The feature lets an administrator migrate a service account to a new type, and the attack abused how that migration is recorded so a user with the right to create a dMSA could inherit the rights of any account in the domain. Microsoft released a fix in August 2025, tracked as CVE-2025-53779, and Akamai's follow-up analysis describes the patch as moving validation into the Kerberos service.

The lesson is wider than one bug. A new Active Directory feature arrives with new permissions to audit, and the patch does not remove the need to know who can create objects in which organizational units. If you have Windows Server 2025 domain controllers, install the update and review who holds the right to create dMSAs.

Most organizations also sync Active Directory with a cloud identity service. The 2026 reports from CrowdStrike and Microsoft both describe attackers targeting these hybrid links: the sync account, federation settings, and tokens issued after a successful phish. An on-premises weakness can become a cloud tenant compromise, and the reverse is also true. A modern assessment looks at both sides of the connection.

• A map of the attack paths from a normal user to Domain Admins, shown as the chain of steps, not a list of isolated findings.
• Proof of what could be reached: which servers, which data, which accounts.
• A fix list in order of effect, because removing one permission often breaks several paths at once.
• A retest to confirm the paths are closed.

1. Give every service account a long random password, or use managed service accounts.
2. Randomize local administrator passwords per machine.
3. Keep administrator accounts out of everyday use and away from workstations.
4. Audit certificate templates and who can enroll.
5. Turn on SMB and LDAP signing and reduce NTLM use.
6. Review who can create objects and write to sensitive attributes in each organizational unit.
7. Alert on Kerberos ticket requests for many service accounts at once, and on changes to privileged groups.

Our engineers map and test these paths by hand, starting from an ordinary employee account or a device on your network, and explain each step so your team can close it. See Active Directory penetration testing, the broader network penetration testing, or request a scoping call.

Facts in this article were checked on 4 November 2026 against these primary sources:

• Akamai: BadSuccessor, abusing dMSA to escalate privileges
• Akamai: analysis of Microsoft's patch (CVE-2025-53779)
• Palo Alto Networks Unit 42, 2026 Global Incident Response Report
• CrowdStrike 2026 Global Threat Report: findings