🕵️ RESEARCH & DEEP DIVES
- New Kerberos abuse path: constrained delegation without protocol transition against SPN-less accounts
A researcher discovered a new Kerberos delegation abuse path enabling constrained delegation without protocol transition against SPN-less accounts.- Applies to Active Directory environments using Kerberos constrained delegation, including accounts trusted for delegation that lack an SPN.
- Combines Elad Shamir's Reflective RBCD with James Forshaw's U2U sacrificial user technique to obtain the forwardable ticket needed for the attack.
- Attack chain: request a TGT and extract its session key, add a machine account via Machine Account Quota, configure RBCD on the target, change the user's password hash to the TGT session key, then perform S4U2Proxy with U2U to impersonate an elevated user.
- Prerequisites: RC4 encryption permitted in the domain, Machine Account Quota enabled (or an SPN-bearing principal already compromised); the sacrificed user account is destroyed in the process.
- The author added S4U2Proxy + U2U support to Impacket (getST.py) via PR #2324 to enable the technique.
🔓 CVEs & KEV
CVE-2026-106013 — artbees Jupiter X Core — CVSS 9.8 — Jupiter X Core through 4.61.0 - Unauthenticated Authentication Bypass via Twitter/...
CVE-2026-110879 — FasterXML jackson-databind — CVSS 9.8 — jackson-databind: PolymorphicTypeValidator bypass via generic type arguments ...