CVE-2026-45504 Part 3: Why One Mailbox Credential Is Enough

svc-legacy-scan has already been through two full series on this site. Impacket Deep Dive Part 3 found it carrying the DONT_REQ_PREAUTH flag in CONTOSO.LOCAL and pulled a crackable AS-REP hash with nothing more than an anonymous LDAP query and GetNPUsers.py:

$krb5asrep$23$svc-legacy-scan@CONTOSO.LOCAL:a1f3c9e0b7d24e118f...  (truncated)

Password Cracking and Wordlist Engineering Part 7 cracked that hash for real, using a custom hashcat rule built from the account’s own naming pattern rather than a stock wordlist:

$ hashcat -m 18200 -a 0 svc-legacy-scan.hash combined-base.txt -r custom.rule
...
$krb5asrep$23$svc-legacy-scan@CONTOSO.LOCAL:a1f3c9e0b7d24e118f...:Sc4nn3r2019!

Sc4nn3r2019!, six years stale, tied to an account with a name that describes exactly the kind of role real organizations hand out without much scrutiny: a scanning or monitoring service account, created once, given a password once, and rarely revisited. Everything the Impacket and Password Cracking series did with that credential afterward stayed inside Active Directory: SPN enumeration, ACL checks in BloodHound, the eventual full chain to Domain Admin. CVE-2026-45504 is a reminder that the credential itself doesn’t know it’s only supposed to be useful against AD. If an account like svc-legacy-scan also holds an Exchange mailbox, which is a genuinely common pattern for scanning and monitoring accounts that need to send alert emails or receive ticketing replies, that same cracked password is also a working EWS login. Nothing in the original recon in Impacket Part 2 confirmed svc-legacy-scan was mail-enabled in this specific lab. The point isn’t that this exact account was exploitable this specific way. It’s that the qualification bar for CVE-2026-45504 is lower than almost anything else covered on this site under the Active Directory tag, and a password recovered for one purpose routinely turns out to be usable for several.

That’s a meaningfully different risk shape than the rest of this site’s AD content. Kerberoasting and AS-REP roasting need a domain account, but the payoff depends on what that account can already reach: group memberships, delegated rights, ACLs that BloodHound has to actually graph before an attacker knows where to go next. CVE-2026-45504 doesn’t care about any of that. It cares about one thing: does this account have a working Exchange mailbox login. No graph, no privilege check, no lateral movement between the credential and the vulnerability. Exchange’s own long-standing over-trust in the domain, the same shape of problem PrivExchange demonstrated years earlier, means the payoff on the other side is out of proportion to how little the attacker needed to get there.

Part 4 covers what actually catches this kind of abuse, both on the Exchange server and on the network watching it.