Active Directory Domain Services Elevation of Privilege Vulnerability

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

How could an attacker exploit this vulnerability?
An attacker could exploit this issue by adding specially crafted Unicode characters to duplicate Service Principal Names (SPNs) or User Principal Names (UPNs). These characters bypass normal Active Directory checks designed to prevent duplicates. If the attacker has permission to modify SPNs on any account, they can create a duplicate SPN for a targeted service. When clients request Kerberos authentication for that service, the domain controller may issue a ticket encrypted with the wrong key, causing the service to reject the ticket. This can lead to a denial of service or force the service to fall back to NTLM authentication if it is enabled. No access to the targeted server is required beyond the initial SPN‑write permission.

Security updates
10.0.17763.8511 — https://support.microsoft.com/help/5078752
10.0.20348.4893 — https://support.microsoft.com/help/5078766
10.0.20348.4830 — https://support.microsoft.com/help/5078737
10.0.19044.7058 — https://support.microsoft.com/help/5078885
10.0.26100.32522 — https://support.microsoft.com/help/5078740
10.0.26100.32463 — https://support.microsoft.com/help/5078736
10.0.26200.8037 — https://support.microsoft.com/help/5079473
10.0.26200.7979 — https://support.microsoft.com/help/5079420
10.0.22631.6783 — https://support.microsoft.com/help/5078883
10.0.25398.2207 — https://support.microsoft.com/help/5078734
10.0.14393.8957 — https://support.microsoft.com/help/5078938
6.2.9200.25973 — https://support.microsoft.com/help/5078775
6.3.9600.23074 — https://support.microsoft.com/help/5078774
10.0.28000.1719 — https://support.microsoft.com/help/5079466