Akamai reports privilege escalation vulnerability in Windows Server 2025 called BadSuccessor

Akamai researcher Yuval Gordon has uncovered a privilege escalation vulnerability in Windows Server 2025 exposing organizations utilizing Active Directory environments witn Server 2025. 

This vulnerability is dubbed "BadSuccessor," and allows attackers to compromise any user in Active Directory, including highly privileged accounts like Domain Administrators, by exploiting the newly introduced delegated Managed Service Accounts (dMSA) feature.

Currently no CVE has been assigned to this vulnerability. It has been reported to Microsoft and acknowledged by the company.

The vulnerability exploits a design flaw in the  delegated Managed Service Account feature that was introduced in Windows Server 2025. The migration process in dMSA relies on simple attribute manipulation instad of validation. By controlling a dMSA and setting the "msDS-ManagedAccountPrecededByLink" attribute to point to a high-value target like a Domain Admin, the attacker can authenticate as the dMSA and inherit all the target's permissions and group memberships.

The attack works by manipulating two attributes on dMSA objects:

• msDS-ManagedAccountPrecededByLink: Set to reference any target user or computer account
• msDS-DelegatedMSAState: Set to value 2 to indicate completed migration

This technique allows any user who controls a dMSA object to control the entire domain through a simulated migration process that requires no actual migration, verification, or oversight.

Beyond basic privilege escalation, the BadSuccessor vulnerability also enables credential compromise: When a dMSA authenticates, it not only inherits the permissions of the superseded account but also gains access to the encryption keys of the original account, enabling attackers to decrypt service tickets and potentially obtain plaintext passwords.

This credential harvesting capability means that attackers can potentially compromise the actual passwords or encryption keys of targeted accounts, not just impersonate them temporarily. 

Windows Server 2025 environments with at least one domain controller running the new operating system, regardless of whether organizations actively use dMSAs. The vulnerability exists in the default configuration and affects any Active Directory domain that includes Windows Server 2025 infrastructure with at least one Windows Server 2025 domain controller. 

Akamai's analysis revealed that in 91% of examined environments, users outside the domain admins group possessed sufficient permissions to execute this attack. 

Akamai reported the findings to Microsoft on April 1, 2025, following which Microsoft classified the issue as moderate severity and indicated it does not meet the threshold for immediate servicing. Microsoft's assessment is based on the requirement that successful exploitation needs specific permissions on dMSA objects, which they consider indicative of already elevated privileges.

Akamai researchers strongly disagree with this severity assessment, arguing that the vulnerability introduces a previously unknown and high-impact abuse path that makes it possible for any user with CreateChild permissions on an organizational unit to compromise any user in the domain and gain similar power to the Replicating Directory Changes privilege used to perform DCSync attacks.

Microsoft has confirmed they are working on a fix, but no patch is currently available and no timeline has been provided for resolution. This leaves organizations in a vulnerable state where they must implement their own protective measures while awaiting an official fix.

Until Microsoft releases an official patch, organizations should implement immediate defensive measures:

• Restrict dMSA Creation Permissions: Organizations are advised to limit the permission to create dMSAs to trusted administrators only. This involves identifying all principals with CreateChild permissions on organizational units and removing these rights from non-essential accounts.
• Enhanced Monitoring: Deploy comprehensive logging and monitoring for dMSA-related activities, including creation, modification, and authentication events. Organizations should configure appropriate SACLs and ensure security information and event management (SIEM) systems are tuned to detect suspicious dMSA activities.

• Permission Auditing: Akamai has released a PowerShell script that helps defenders identify which identities have permissions to create dMSAs in their domain and which organizational units are affected, highlighting where the BadSuccessor attack could be executed.