Summary
Impact: Spoofing. Microsoft rating: Important. Not known to be exploited, publicly disclosed before the fix — Exploitation Unlikely. Customer action: Required.
Details
What actions do I need to take to be protected from this vulnerability?
No admin action is required. Customers that have NTLM completely disabled in their environment and would like to keep the feature working, should open a support case requesting to reenable the feature. For more information, please see this article: https://learn.microsoft.com/en-us/defender-for-identity/deploy/remote-calls-sam
According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?
An unauthenticated attacker with LAN access could exploit this vulnerability.
Vulnerabilities 1
-
Medium 6.5
Microsoft Defender for Identity Spoofing Vulnerability
Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network.
Revision history
-
#1
Information published.
References
-
CVE-2025-26685 Microsoft Defender for Identity Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26685
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss