CVE-2022-26923: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

CVE-2022-26923 is a privilege escalation vulnerability in Microsoft Active Directory Domain Services. An authenticated user can manipulate attributes on computer accounts they own or manage and then obtain a certificate from Active Directory Certificate Services that elevates privileges to SYSTEM. This matters because successful abuse can give an attacker high-level control inside a domain, enabling further lateral movement or persistence. Confirm all version and configuration details against the vendor advisory.

How it works

The weakness is classified as CWE-295. In this class of flaw, improper handling of certificate-related attributes allows an authenticated principal to alter computer-account properties under their control. Once those attributes are changed, the attacker can request a certificate from Active Directory Certificate Services that the domain treats as highly privileged. The resulting certificate can then be used to authenticate as SYSTEM. Exact request formats and attribute names are not detailed here; defenders must review the vendor advisory for the precise mechanics.

Am I affected? How to find it in your systems

Microsoft Active Directory Domain Services is typically present on domain controllers and any servers that host or interact with Active Directory Certificate Services. Inventory all domain controllers and certificate-authority servers. Check whether computer accounts can be created or managed by non-administrative users and whether certificate templates allow authentication or enrollment that could lead to elevated rights. Review domain-controller security logs and certificate-authority audit logs for unexpected computer-account attribute changes or certificate requests issued shortly after such changes. Look for anomalous Kerberos or certificate-based authentication events that result in SYSTEM-level access. Specific affected builds and configurations must be confirmed against the vendor advisory.

How to remediate

Apply the updates supplied by Microsoft for Active Directory Domain Services as directed in the vendor advisory; this is the primary remediation required by CISA. After patching, verify that computer-account attribute modification rights are restricted to appropriate administrative groups and that certificate templates no longer permit the escalation path. Harden certificate enrollment by enforcing manager approval where feasible, removing overly permissive templates, and auditing enrollment permissions. Re-validate that domain controllers and certificate authorities are running only supported, fully updated software.

If you can't patch immediately

Segment domain controllers and certificate authorities so that only necessary management hosts can reach them. Disable or tightly restrict any certificate templates that allow authentication certificates to be issued based on computer-account attributes controllable by ordinary users. Implement virtual patching or WAF rules that block anomalous certificate enrollment requests if your environment supports such controls. Increase monitoring of computer-account attribute writes and certificate issuance events, alerting on any combination that matches the described abuse pattern. These steps reduce risk until the vendor update can be applied.

If your data may have been exposed

Actively exploited privilege-escalation vulnerabilities can lead to domain compromise and subsequent data exposure. If you suspect this CVE was used in your environment, treat the incident as a potential breach: isolate affected systems, preserve logs, and begin forensic review. You can run a free exposure scan of your email addresses against known breach data sets to determine whether credentials or personal information have already appeared in public dumps.