Microsoft Defender Spoofing Flaw Enables Privilege Escalation and AD Access

A newly disclosed spoofing vulnerability, CVE-2025-26685, affects Microsoft Defender for Identity (MDI), enabling unauthenticated attackers to capture Net-NTLM hashes of Directory Service Accounts (DSAs).