CVE-2022-26925: Microsoft Windows LSA Spoofing Vulnerability

CVE-2022-26925 is a spoofing vulnerability in the Local Security Authority (LSA) component of Microsoft Windows. An attacker can coerce a domain controller to authenticate to the attacker using NTLM. This matters because successful abuse can undermine domain authentication trust and enable further lateral movement or credential abuse inside Windows environments. Confirm all product and configuration details against the vendor advisory and related CISA guidance.

How it works

The weakness is classed as CWE-306 (Missing Authentication for Critical Function). In plain terms, the LSA path involved does not adequately ensure that a critical authentication-related action is properly authenticated before proceeding. Per the CISA summary, an attacker can coerce the domain controller to authenticate to the attacker using NTLM. This is a spoofing issue: the attacker tricks the domain controller into treating the attacker-controlled endpoint as a legitimate authentication target. Exact exploit mechanics, required privileges, and network preconditions are not detailed here and must be confirmed against the Microsoft advisory. Defenders should treat this as an NTLM coercion / authentication-spoofing class problem against domain controllers and related Windows hosts that participate in LSA authentication flows.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows. Domain controllers are the primary concern given the described coercion of domain-controller NTLM authentication, but inventory all Windows systems that run LSA-related authentication services and participate in domain authentication.

• Inventory: enumerate domain controllers, member servers, and workstations via Active Directory, configuration-management databases, or endpoint management tools. Flag systems that still allow NTLM and that expose authentication-related interfaces.
• Version and configuration checks: compare installed Windows builds and security updates against the Microsoft advisory for CVE-2022-26925. Confirm whether NTLM is restricted, whether SMB/signing and channel-binding protections are enforced, and whether LSA-related hardening is applied. Specifics must be confirmed against the vendor advisory.
• Telemetry and log signs: monitor for unusual NTLM authentication traffic originating from domain controllers toward unexpected hosts, sudden spikes in NTLM challenge/response activity, failed or anomalous LSA events, and authentication attempts to non-domain or attacker-controlled endpoints. Correlate Windows Security and System logs, domain-controller authentication logs, and network flow data for coercion patterns. Absence of public exploit detail does not mean absence of risk—treat unexplained DC-initiated NTLM as suspicious.

How to remediate

Patch first. Apply the remediation actions outlined in CISA guidance for the June Microsoft updates and the corresponding Microsoft security update for CVE-2022-26925. Confirm the exact packages and reboot requirements in the vendor advisory before deployment.

• Prioritize domain controllers and then tier-0/tier-1 Windows systems that handle authentication.
• After patching, validate that the update is present and that NTLM-related hardening recommended by Microsoft is in place.
• For this class of issue, reduce NTLM usage where possible, enforce SMB signing, and apply LSA protection and authentication hardening consistent with Microsoft guidance. Re-test authentication flows after changes.

If you can't patch immediately

Use compensating controls to lower the chance of successful coercion until patches are applied.

• Segmentation: restrict network paths so domain controllers cannot initiate or complete NTLM authentication to untrusted or non-essential hosts. Limit outbound connectivity from DCs.
• Protocol hardening: disable or restrict NTLM where business-compatible; require signing and extended protection for authentication where supported. Confirm settings against Microsoft documentation.
• Monitoring and detection: increase alerting on DC-originated NTLM, anomalous LSA events, and authentication to unknown endpoints. Retain relevant logs for investigation.
• Virtual patching / controls: where available, use host or network controls that block known coercion patterns; these are temporary and do not replace the vendor update.
• Feature reduction: temporarily disable non-essential services that participate in the vulnerable authentication path if your environment allows it, after testing impact.

If your data may have been exposed

Actively exploited authentication vulnerabilities can lead to domain compromise and subsequent data exposure even when ransomware use is not documented for this CVE. If you suspect coercion or unauthorized authentication activity, follow incident-response procedures: isolate affected systems, reset relevant credentials, and review domain authentication logs. You can also run a free exposure scan of your email addresses against known breach data to check whether associated accounts appear in prior breaches.