CVE-2022-26923
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Description
CVE-2022-26923 is a privilege escalation vulnerability in Microsoft Active Directory Domain Services that allows an authenticated user to escalate privileges to SYSTEM by manipulating attributes on computer accounts they own or manage. By abusing Active Directory Certificate Services (AD CS), an attacker can request a certificate that grants elevated access to domain resources. CISA has added CVE-2022-26923 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an extraordinarily high EPSS score of 91.7% (99.7th percentile), this vulnerability is among the most likely to be exploited across all known CVEs.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19297 |
| microsoft | windows 10 1607 | < 10.0.14393.5850 |
| microsoft | windows 10 1809 | < 10.0.17763.4252 |
| microsoft | windows 10 1909 | < 10.0.18363.2274 |
| microsoft | windows 10 20h2 | < 10.0.19042.1706 |
| microsoft | windows 10 21h1 | < 10.0.19043.1706 |
| microsoft | windows 10 21h2 | < 10.0.19044.1706 |
| microsoft | windows 11 21h2 | < 10.0.22000.1817 |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2012 | r2 |
| microsoft | windows server 2016 | < 10.0.14393.5850 |
| microsoft | windows server 2019 | < 10.0.17763.4252 |
| microsoft | windows server 2022 | < 10.0.20348.1668 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26923(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26923(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26923(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CVE-2022-26923 exploits improper privilege management in Microsoft Active Directory Domain Services, where the certificate enrollment process fails to properly validate the privilege level of the requesting entity. An authenticated user can manipulate computer account attributes to obtain a certificate from Active Directory Certificate Services that grants SYSTEM-level access, bypassing the intended authorization boundaries of their current privilege level.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2022-26923 represents a critical threat to enterprise Active Directory environments. The vulnerability requires only low-privilege authenticated access to a domain, which is readily available to any domain-joined user or compromised workstation. Once exploited, the attacker can escalate to SYSTEM privileges, effectively gaining complete control over the domain infrastructure. Confidentiality, integrity, and availability of the entire Active Directory environment are at severe risk, as SYSTEM-level access enables extraction of all domain credentials, modification of security policies, creation of persistent backdoor accounts, and disruption of authentication services. The EPSS score of 91.7% (99.7th percentile) places this vulnerability in the top fraction of a percent for exploitation likelihood, indicating near-certain exploitation activity in exposed environments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-26923 by adding it to the Known Exploited Vulnerabilities catalog on August 18, 2022, with a remediation deadline of September 8, 2022. The EPSS score of 91.7% (99.7th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted Active Directory vulnerabilities. The technique of abusing AD CS for privilege escalation has been extensively documented in security research, and multiple exploitation tools and methodologies are publicly available that target certificate-based privilege escalation paths in Active Directory environments. The low barrier to exploitation — requiring only standard domain user credentials — combined with the SYSTEM-level impact makes this an extremely attractive target for both external attackers and insider threats.
Remediation
- Apply Microsoft security updates immediately: Install the patches from Microsoft's May 2022 Patch Tuesday that address CVE-2022-26923, as referenced in the Microsoft Security Response Center advisory.
- Audit Active Directory Certificate Services configuration: Review all certificate templates for overly permissive enrollment permissions and ensure that computer account attributes cannot be manipulated to request unauthorized certificates.
- Implement certificate enrollment restrictions: Configure AD CS to require manager approval for certificate requests and restrict which principals can enroll in sensitive certificate templates.
- Monitor for suspicious certificate enrollment activity: Enable auditing of certificate enrollment events and alert on unusual certificate requests, particularly those from low-privilege accounts requesting machine certificates with elevated permissions.
- Review and harden computer account management permissions: Restrict which users can create or modify computer account attributes in Active Directory, following the principle of least privilege for delegation of computer account management.
Technical Details
CVE-2022-26923 exploits a flaw in how Microsoft Active Directory Domain Services interacts with Active Directory Certificate Services (AD CS) during certificate enrollment. The vulnerability allows an authenticated domain user to manipulate attributes on computer accounts they own or manage — specifically the dNSHostName and servicePrincipalName attributes — to impersonate a domain controller or other high-privilege computer. When the manipulated computer account then requests a certificate from AD CS using a template that permits machine enrollment, the certificate is issued with the identity of the spoofed machine. This certificate can then be used for Kerberos authentication as the impersonated machine, granting the attacker SYSTEM-level privileges on the domain. The attack chain leverages the trust relationship between AD DS and AD CS, where AD CS relies on attributes controlled by AD DS without performing independent validation of the requesting entity's true identity. The low privilege requirement makes this vulnerability exploitable by any domain user who can create or manage computer objects.
Frequently Asked Questions
Is CVE-2022-26923 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-26923 by including it in the Known Exploited Vulnerabilities catalog. The EPSS score of 91.7% (99.7th percentile) indicates near-certain exploitation activity. Multiple public tools and techniques exist for exploiting AD CS privilege escalation paths, making this vulnerability accessible to a wide range of threat actors.
What products are affected by CVE-2022-26923?
CVE-2022-26923 affects Microsoft Active Directory Domain Services in conjunction with Active Directory Certificate Services. All Windows Server versions running AD DS with AD CS configured are potentially vulnerable. The vulnerability impacts enterprise environments where users have the ability to create or manage computer accounts.
How do I fix CVE-2022-26923?
Apply the Microsoft security updates from the May 2022 Patch Tuesday that address CVE-2022-26923. Additionally, audit AD CS certificate templates for overly permissive enrollment settings, restrict computer account management permissions, and implement certificate enrollment approval workflows.
How severe is CVE-2022-26923?
CVE-2022-26923 is an extremely severe privilege escalation vulnerability with an EPSS score of 91.7% (99.7th percentile), indicating near-certain exploitation. The vulnerability allows any authenticated domain user to escalate to SYSTEM privileges by abusing Active Directory Certificate Services, potentially compromising the entire Active Directory infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.