How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed

CrowdStrike describes CVE-2026-20929: a Kerberos authentication-relay technique that abuses DNS CNAME/alias behavior to induce service tickets to be issued and relayed to attacker-controlled endpoints, enabling unauthorized authentication to downstream services and potential lateral movement in Active Directory environments. The blog outlines detection signals (suspicious DNS CNAME changes, mismatched SPNs/hostnames, anomalous AS/TGS traffic and service-ticket relays), mitigation steps (apply vendor updates if available, remove/disable unnecessary DNS aliases, enforce constrained delegation,强化