CVE-2022-26925
Microsoft Windows LSA Spoofing Vulnerability
Description
CVE-2022-26925 is a spoofing vulnerability in the Microsoft Windows Local Security Authority (LSA) that allows an attacker to coerce a domain controller to authenticate to the attacker using NTLM. By exploiting this flaw, an attacker can force the domain controller to send its NTLM authentication hash to an attacker-controlled system, enabling relay attacks that can lead to full domain compromise. CISA has added CVE-2022-26925 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 37.4% (97.1st percentile), this vulnerability has a very high exploitation probability and represents a critical risk to Active Directory environments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19297 |
| microsoft | windows 10 1607 | < 10.0.14393.5125 |
| microsoft | windows 10 1809 | < 10.0.17763.2928 |
| microsoft | windows 10 1909 | < 10.0.18363.2274 |
| microsoft | windows 10 20h2 | < 10.0.19042.1706 |
| microsoft | windows 10 21h1 | < 10.0.19043.1706 |
| microsoft | windows 10 21h2 | < 10.0.19044.1706 |
| microsoft | windows 11 21h2 | < 10.0.22000.675 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5125 |
| microsoft | windows server 2019 | < 10.0.17763.2928 |
| microsoft | windows server 2022 | < 10.0.20348.707 |
| microsoft | windows server 20h2 | < 10.0.19042.1706 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26925(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26925(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26925(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2022-26925 exploits improper authentication in the Windows LSA subsystem, where the authentication protocol can be manipulated to coerce the domain controller into initiating NTLM authentication with an attacker-controlled endpoint. The LSA fails to properly validate the legitimacy of authentication requests, allowing an attacker to trigger outbound NTLM authentication that can then be relayed to compromise other services in the Active Directory environment.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2022-26925 is a critical threat to Active Directory environments because it enables NTLM relay attacks that can lead to full domain compromise. The vulnerability allows an unauthenticated attacker who can reach the domain controller on the network to coerce it into authenticating via NTLM, capturing the domain controller's authentication hash. This hash can then be relayed to other services to authenticate as the domain controller, granting the attacker domain administrator privileges. Confidentiality of the entire domain is at risk as the attacker can access all domain resources; integrity is compromised as domain-level access allows modification of any AD object; and availability can be disrupted through domain controller manipulation. The EPSS score of 37.4% (97.1st percentile) confirms very high exploitation activity, reflecting the critical nature of this attack path for Active Directory compromise.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-26925 in the wild by adding it to the Known Exploited Vulnerabilities catalog on July 1, 2022, with a remediation deadline of July 22, 2022. The EPSS score of 37.4% (97.1st percentile) indicates very high exploitation probability. CISA's advisory includes a special warning: the required update may break PIV/CAC authentication when deployed to domain controllers without additional configuration changes. The vulnerability is related to the PetitPotam attack technique, which has been extensively documented and tooled in the security community, making exploitation accessible to a wide range of threat actors.
Remediation
- Apply Microsoft security updates carefully: Install the June 2022 Microsoft patches that address CVE-2022-26925, but read CISA implementation guidance carefully before deploying to domain controllers, as the update may break PIV/CAC authentication without additional configuration.
- Enforce EPA and disable NTLM where possible: Enable Extended Protection for Authentication (EPA) on all critical services and disable NTLM authentication where feasible, forcing the use of Kerberos which is not vulnerable to relay attacks.
- Restrict NTLM traffic at the network level: Implement network policies that restrict NTLM authentication traffic to only necessary paths, blocking outbound NTLM from domain controllers to untrusted endpoints.
- Monitor for NTLM relay attack indicators: Deploy monitoring for suspicious NTLM authentication patterns, particularly domain controllers initiating outbound NTLM authentication to unexpected destinations.
- Implement SMB signing on all domain controllers: Enable mandatory SMB signing to prevent relay attacks that leverage captured NTLM hashes for SMB-based authentication to other domain resources.
Technical Details
CVE-2022-26925 is a spoofing vulnerability in the Windows Local Security Authority (LSA) that enables NTLM coercion attacks against domain controllers. The vulnerability allows an attacker to trigger the domain controller's LSA to initiate an NTLM authentication handshake with an attacker-controlled endpoint. Once the domain controller sends its NTLM authentication response (which contains a hash of its credentials), the attacker can relay this authentication to other services in the domain to impersonate the domain controller. This attack is related to the PetitPotam technique, which uses the MS-EFSRPC (Encrypting File System Remote Protocol) to coerce NTLM authentication. The combination of NTLM coercion with relay attacks is particularly devastating because the domain controller's machine account has extensive privileges across the Active Directory environment. The attack requires network access to the domain controller but no authentication, making it exploitable by any attacker who has gained a foothold on the internal network.
Frequently Asked Questions
Is CVE-2022-26925 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-26925 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 37.4% (97.1st percentile) indicates very high exploitation activity. The vulnerability is related to the well-known PetitPotam attack technique.
What products are affected by CVE-2022-26925?
CVE-2022-26925 affects Microsoft Windows through the Local Security Authority (LSA) subsystem, specifically impacting domain controllers in Active Directory environments. All Windows Server versions running as domain controllers are potentially affected.
How do I fix CVE-2022-26925?
Apply the June 2022 Microsoft security updates, but follow CISA implementation guidance carefully when deploying to domain controllers, as the update may break PIV/CAC authentication. Additionally, enable Extended Protection for Authentication, disable NTLM where possible, and enforce SMB signing.
How severe is CVE-2022-26925?
CVE-2022-26925 is a critical vulnerability with an EPSS score of 37.4% (97.1st percentile) that can lead to full Active Directory domain compromise through NTLM relay attacks. The ability to coerce domain controller authentication and relay it to gain domain administrator access makes this one of the most impactful Windows vulnerabilities for enterprise environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.