CVE-2022-26923: Microsoft Active Directory Domain Services certificate validation privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA's KEV catalog with a high EPSS score and allows a low-privileged domain user to become domain administrator with no user interaction.

What it is

Active Directory Domain Services fails to properly validate certificate attributes, allowing a low-privileged domain user to obtain a certificate that impersonates a domain controller. This lets the attacker escalate to domain administrator, which is why it was added to CISA's Known Exploited Vulnerabilities catalog.

Impact

An authenticated domain user can gain domain administrator privileges, giving full control over the Active Directory forest. This enables credential theft, persistence, and further compromise of all domain-joined systems.

Attack surface

Reachable over the network by any authenticated domain user with no user interaction required, per the CVSS vector AV:N/AC:L/PR:L/UI:N. The attacker abuses the certificate enrollment service to request a certificate with spoofed machine attributes.

Exploitation

CISA added this to the KEV catalog on 2022-08-18 with a remediation due date of 2022-09-08, and EPSS shows a 30-day probability of 0.835 (99.7th percentile), indicating active exploitation is likely.

What to do

• Apply the Microsoft security updates listed in the MSRC advisory for all affected Windows client and server versions.
• Enforce strong certificate mapping on Active Directory Certificate Services to prevent spoofed certificate attributes.
• Audit and restrict certificate enrollment permissions so only authorized accounts can request domain controller certificates.
• Monitor for and remove any unauthorized certificates issued to non-domain-controller accounts.
• Follow CISA KEV required actions and apply vendor instructions by the due date.

Detection

• Monitor Active Directory Certificate Services logs for certificate requests or issuance to accounts with domain controller attributes.
• Alert on new or modified computer accounts that gain domain controller service principal names or DNS hostnames.
• Review Windows security event logs for unusual certificate enrollment activity from low-privileged users.
• Correlate certificate issuance events with subsequent privileged authentication or directory replication activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.