Security experts warn that the newly found vulnerability in Windows Server 2025 risks the security of Active Directory environments around the globe. With the new found, easily exploitable vulnerability, one could escalate privileges and compromise any user in the AD domain. This is possible as long as the user has minimal permissions, which means a low-level access account can be exploited through this vulnerability. Unlike BadSuccessor by Akamai Technologies, the vulnerability does not require special permissions.

BadSuccessor Explained: Why It’s a Big Deal

This vulnerability traces back to the flaws caused by the introduced feature known as delegated Managed Service Accounts or dMSAs, which were initiated in Windows Server 2025. Designed to enhance service tag management, dMSAs were intended to limit attacks like Kerberoasting, as it is a type of cyberattack that uses the Kerberos protocol to do damage. Criminals who want to harm steal Kerberos service tickets to get to the plaintext passwords of network service accounts. The hackers then use these service accounts to do things like steal data, spread malware, and more.

According to Microsoft’s documentation, dMSAs are described as accounts that can be created either standalone or as replacements for existing service accounts, blocking authentication with the old account’s password and rerouting authentication to the dMSA. However, it no longer serves a purpose and dMSAs now allow organizations to effortlessly transform outdated non-managed service accounts into managed ones. Nevertheless, this flaw introduces a critical risk. Senior Security researchers at Akamai state that

“due to misuse by dMSAs, any principal in a domain can be easily controlled if control is available through minimal permissions”

under an Organizational Unit in Active Directory. This design is now vulnerable to an attack such as those that BadSuccessor exploits to gain access and control without authorization.

As of May 2025, Microsoftt has recognized the vulnerability and plans to issue a patch, but currently, there is no fix available. This leaves organizations exposed and dependent on alternative strategies to mitigate and reduce risk. Infrequent checkups on organizational units combined with service accounts create gaps that multiple users can breach without consequence due to unnecessary exploited rights. What makes BadSuccessor uniquely dangerous is that it does not require the domain to use dMSAs actively. If there is even a single Windows Server 2025 domain controller in the ecosystem, the vulnerability is ripe for exploitation. Akamai’s investigation uncovered that in 91% of the reviewed environments, users who were outside the domain admins group had the requisite permissions to execute the attack. This makes the vulnerability not just widespread but easily accessible to attackers. This attack enables the privilege escalation; arguably one of the worst security threats, since it allows an attacker to gain abilities far more than their initial permissions. Once this is achieved, the attacker can compromise any Active Directory user account, which could lead to a complete domain takeover and severely cripple the organization’s IT infrastructure.

Similarly, the essence of BadSuccessor exploit stems from the delegated Managed Service Account (dMSA) concerning permissions during account migration. While dMSAs were designed to ease management overhead through automation, they have a critical flaw: when a dMSA replaces a service account, it inherits all the permissions of the service account. This includes permissions to access the devices and resources tied to the legacy account. The vulnerability permits attackers with minimal permissions to control dMSAs and elevate their privileges predominantly.

Active Directory requires monitoring for dMSA

Accounts tied to organizational units suffer from a lack of access freedom, negating least privilege principles. Ensuring service accounts can only be modified by a minimal number of approved users fills the framework. Microsoft offers timely updates, thus implementing prompt patching once released, maintaining an informed status guarantees proactive protection. Active Directory is critical to enterprise identity and access management, and it’s under increasing attack, as evidenced by the addition of BadSuccessor.

Just a few months earlier, in 2025, Active Directory Domain Services (AD DS) from Microsoft was affected as part of Patch Tuesday. Even though CVE-2025-21293 was found in September 2024, the public release of the proof-of-concept (PoC) exploit has made people more worried, and attackers have been seen using the flaw in real life. Since many corporate networks depend on Active Directory for authentication and authorization, companies should apply the latest security patches as soon as possible. Moreover, previously fixed Active Directory exploits from 2021 showcased a full domain takeover via chained exploits. These exploits highlight the architectural challenges of securing Active Directory ecosystems domains that are increasingly feature-rich and finely configurable, introducing hidden new attack surfaces. Organizations need to be ready for defence-in-depth with enduring and unfailing security postures, quicker patching, round-the-clock oversight, and stringent control of access at all times.

What’s Next? Staying Ahead of Attacks

The revelation of BadSuccessor demonstrates the sensitivity of the balance of security features, as any given enterprise software feature or new technology moves towards unprincipled design. The intention behind the introduction of dMSAs was to shift security and operational burdens to designated administrators and simplify system functions. However, the flaw illustrates that any feature or purpose-driven additions can compromise software security architecture. Until Microsoft provides patch guidance, organizations using Windows Server 2025 are advised to actively self-assess against risk exposure and remediate Active Directory deployment configuration vulnerabilities. Due to the ease of exploitation and the widespread use of vulnerable permissions, the likelihood of a full compromise remains high.

The breach incident may motivate Microsoft and other providers to impose stricter security audits for new capabilities, particularly those related to changes in identity and access management. As for enterprises, they should start implementing multiple defensive lines, monitoring, and zero-trust frameworks to minimize the impact of future risks. The vulnerability of BadSuccessor within Windows Server 2025 poses a significant risk to Active Directory security as it allows attackers to easily subjugate any domain user. This is critical for organizations globally since it takes advantage of the delegated Managed Service Account feature, which is on by default, along with pervasive permissive access controls. At this moment, there is no available patch, which necessitates immediate protective measures to defend against targeted enterprise attacks.