Year in Review: Attacks on identity and MFA

For our third focussed topic for Talos' 2024 Year in Review, we tell the story of how identity has become the pivot point for adversarial campaigns. The main themes of this story are credential abuse, Active Directory attacks, and MFA workarounds. Valid account usage was the 1 way attackers got i...

Citrix Cloud Intermittent loss of connectivity to On-Prem AD

When attempting to run MCS Process - Ran into issues contacting the On-Prem Active Directory Citrix.CloudServices.ADAgent EventID 10102 Errors: Message=Unable to connect to the forest associated with domain "DOMAINNAME.local"...

CVE-2025-29810

Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network...

CVE-2025-27740

Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network...

Active Directory Certificate Services Privilege Escalation

The vulnerability of Active Directory Certificate Services on Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to gain increased privileges remotely...

Zohocorp ManageEngine ADManager Plus 7210 - Elevation of Privilege

Exploit Title: ManageEngine ADManager Plus Build 7210 Elevation of Privilege Vulnerability Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/ad-manager/ Details:...

Microsoft Identity Web 日志信息泄露漏洞

Microsoft Identity Web is an Azure Active Directory open source to help create protected web applications and web APIs using the Microsoft Identity Platform and Azure AD B2C. A log information disclosure vulnerability exists in Microsoft Identity Web, which stems from the fact that sensitive...

CVE-2025-29810

Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network...

CVE-2025-29810

Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network...

CVE-2025-27740

Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network...

CVE-2025-27740

Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network...

CVE-2025-29810 Active Directory Domain Services Elevation of Privilege Vulnerability

...

CVE-2025-29810 Active Directory Domain Services Elevation of Privilege Vulnerability

...

CVE-2025-29810

CVE-2025-29810 corresponds to an improper access control in Active Directory Domain Services that can allow an authenticated attacker to elevate privileges over the network. The NCSC advisory groups CVE-2025-29810 under Windows Active Directory Domain Services with an impact described as ‘Obtain ...

CVE-2025-27740 Active Directory Certificate Services Elevation of Privilege Vulnerability

...

CVE-2025-27740

CVE-2025-27740 affects Windows Active Directory Certificate Services and is described as a weakness in authentication that enables an authorized attacker to elevate privileges over the network. The connected documents confirm the affected component as Windows Active Directory Certificate Services...

CVE-2025-27740 Active Directory Certificate Services Elevation of Privilege Vulnerability

...

April 8, 2025—KB5055521 (OS Build 14393.7969)

None None...

Active Directory Domain Services Elevation of Privilege Vulnerability

Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network...

Active Directory Certificate Services Elevation of Privilege Vulnerability

Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network...