Research & Insights

Security Blog

Vulnerability research, technical deep dives, and offensive security insights from the Atvik team.

Kerberos Relay via CNAME Abuse: Reproducing CVE-2026-20929 in GOAD
ResearchMarch 27, 2026

Kerberos Relay via CNAME Abuse: Reproducing CVE-2026-20929 in GOAD

We reproduced the Kerberos CNAME relay attack (CVE-2026-20929) in a GOAD lab and dumped SAM hashes across domain boundaries. Pure Kerberos, zero NTLM. Here is how it works, the issues we hit, and what it means for your environment.

Read article