BadSuccessor Dangerous dMSA Permissions

BadSuccessor is a privilege escalation vulnerability in Active Directory, introduced with the delegated Managed Service Accounts (dMSAs) feature in Windows Server 2025. It allows attackers to create or modify a dMSA to inherit the permissions of a high-privilege target, potentially leading to full domain compromise. Exploitation requires at least one Windows Server 2025 domain controller in the domain.

Microsoft patched the BadSuccessor vulnerability as CVE-2025-53779. However, because the technique can still be used for persistence or lateral movement on patched systems, organizations should apply the patch and restrict dMSA creation and modification permissions to trusted users.

Name: BadSuccessor Dangerous dMSA Permissions

Codename: C-BAD-SUCCESSOR

Severity: Critical

Type: Active Directory Indicator of Exposure

Family: Access Control and Permissions