Microsoft Defender for Identity Improper Authentication — Spoofing (CVE-2025-26685)
An improper-authentication flaw in Microsoft Defender for Identity (the sensor that monitors AD domain controllers) allows an attacker on an adjacent network to perform spoofing against the sensor. Service-side fix — no on-prem patching is required, but operators should confirm sensor version and review related Defender for Identity health alerts.
The attack does not give code execution. Instead it lets an adjacent-network attacker poison the identity telemetry that Defender for Identity surfaces — potentially hiding their own lateral movement or framing a different account. Realistic abuse: an attacker who already has a foothold on a domain-joined host poisons MDI telemetry to evade detection while continuing the intrusion.
CVE-2025-26685 is an authentication-bypass / spoofing flaw in the Defender for Identity sensor. The MDI sensor inspects authentication traffic on the domain controller, and improperly-validated request signatures allow an attacker on the same network segment to spoof identities or impersonate other entities to the sensor — degrading the integrity of the telemetry MDI feeds back to the Defender XDR portal.
Probably yes if any of these apply:
Affected OS versions
Microsoft addressed CVE-2025-26685 on the May 13 2025 release date as part of the broader May 2025 Patch Tuesday set. Defender for Identity is a cloud-managed service with on-prem sensors, so most of the fix is delivered service-side; operators should verify sensor version and check for spoofing-related alerts in the MDI portal.
Manual remediation steps
⏱ 15 minutes per sensor (most auto-update without reboot)Identify Sensor Status
In the Microsoft Defender portal (security.microsoft.com):
Or on each domain controller:
# Check installed MDI sensor version
Get-Service -Name AATPSensor
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Azure Advanced Threat Protection Sensor" -ErrorAction SilentlyContinue).DisplayVersion
Apply the Fix
MDI sensors auto-update by default. If auto-update has been disabled or a sensor is on an older build:
Review for Suspicious Activity
In the Defender portal:
Verify
In the Defender portal: every domain-controller sensor shows the post-May-2025 build and "Healthy" status.
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References