CVE-2022-26923

What it actually does

CVE-2022-26923 is a network-exploitable Active Directory Domain Services privilege-escalation flaw that can allow a low-privileged authenticated domain user to obtain privileges equivalent to a domain controller under vulnerable Active Directory Certificate Services and certificate-based authentication conditions. The abuse commonly involves creating or modifying a computer account, manipulating attributes such as DNS hostname/service principal names, requesting a machine certificate from an enterprise certificate authority, and using that certificate for Kerberos authentication. Successful exploitation can lead to domain-wide compromise, including credential theft, directory replication abuse, creation of privileged accounts, Group Policy manipulation, and control of domain-joined systems.

Why it matters to the business

This vulnerability can turn an ordinary domain user account into full control of a Windows domain, making it a high-impact enterprise risk. Because it is listed in CISA KEV, has been exploited in the wild, and has a high EPSS likelihood score, exposed organizations should treat it as an urgent Active Directory hardening and patching priority. If exploited, business consequences can include widespread workstation and server takeover, disruption of authentication services, theft of sensitive data, persistence across the Windows estate, and costly incident response or domain recovery operations.

How an attack unfolds

An attacker first needs valid low-privileged domain credentials and network reachability to domain services and, typically, enterprise certificate enrollment endpoints. The attacker creates or controls a computer account, abuses default or permissive Active Directory settings such as the ability for users to join machines to the domain, and modifies the computer object's hostname-related attributes to impersonate a more privileged system, often a domain controller. The attacker then requests a certificate from Active Directory Certificate Services using a machine-authentication template. On vulnerable or unpatched systems, the issued certificate can be mapped incorrectly, allowing the attacker to authenticate as the impersonated computer account. From there, the attacker can obtain Kerberos tickets and perform privileged domain actions such as DCSync, extraction of password hashes, creation of administrative users, or deployment of malicious Group Policy. Public tooling has automated much of this attack path, which explains the high exploitation likelihood and inclusion in the Known Exploited Vulnerabilities catalog.

How to fix it

Apply the Microsoft security updates that address CVE-2022-26923 across all affected Windows clients, Windows servers, domain controllers, and systems providing Active Directory Certificate Services. Because no exact fixed versions were provided, use the applicable May 2022 or later cumulative/security updates for Windows 8.1, Windows 10, Windows 11, Windows Server 2012, 2016, 2019, and 2022, and continue to the latest supported cumulative update level. Ensure domain controllers and certificate authorities are patched consistently; partial patching can leave exploitable authentication paths or cause certificate-authentication inconsistencies. Harden Active Directory Certificate Services by disabling unnecessary templates, restricting enrollment on machine templates, requiring manager approval or authorized signatures where appropriate, and reviewing certificate templates that allow client authentication. Reduce the default ability of ordinary users to create computer accounts by setting ms-DS-MachineAccountQuota to 0 or a tightly controlled value, and delegate computer-account creation only to approved administrative groups. Monitor and restrict changes to dNSHostName, servicePrincipalName, userAccountControl, and certificate-related attributes on computer objects. Review Microsoft guidance for KB5014754 certificate-based authentication hardening and ensure strong certificate mapping is enforced where applicable. If immediate patching is not possible, prioritize compensating controls around AD CS enrollment, computer-account creation, certificate template permissions, and high-fidelity monitoring for suspicious computer-account modifications and certificate requests.

How to confirm the fix worked

Confirm all domain controllers, enterprise certificate authorities, and supported Windows servers/clients have installed the relevant May 2022 or later cumulative updates and are on current security patch levels. Verify Active Directory Certificate Services template permissions and confirm low-privileged users cannot enroll in unnecessary machine/client-authentication templates. Check the domain's ms-DS-MachineAccountQuota value and validate that ordinary domain users cannot create arbitrary computer accounts unless explicitly required. Test whether a low-privileged account can create a computer object, modify dNSHostName/servicePrincipalName values, and enroll for a usable machine certificate; the expected secure outcome is denial or non-exploitable certificate mapping. Review domain controller authentication logs and certificate authority issuance logs for suspicious historical activity, especially around newly created computer accounts and certificates issued shortly afterward. Validate certificate-based authentication hardening settings using Microsoft's current AD CS and Kerberos guidance, and confirm no certificate templates unintentionally permit privilege escalation paths.

Typical attack path

1. Obtain valid low-privileged Active Directory domain credentials through phishing, password spraying, reuse, malware, or another initial-access method.
2. Enumerate domain configuration, certificate authorities, certificate templates, domain controllers, and computer-account creation permissions.
3. Create a new computer account or identify a controlled computer account that can be modified.
4. Manipulate computer object attributes such as dNSHostName and servicePrincipalName to collide with or impersonate a high-value host, commonly a domain controller.
5. Request a machine certificate from Active Directory Certificate Services using an enabled template that permits the manipulated identity to enroll.
6. Use the issued certificate for Kerberos PKINIT or related certificate-based authentication to obtain tickets as the impersonated machine account.
7. Abuse the resulting privileges to perform domain replication, extract credentials, modify privileged groups, create persistence, or deploy payloads across the domain.
8. Clean up obvious artifacts such as temporary computer accounts, attribute changes, certificate requests, or tool output to hinder investigation.

How to detect it

Look for evidence of exploitation by correlating Active Directory account-management events, directory-service-change events, certificate authority issuance logs, and Kerberos authentication logs. High-signal activity includes a low-privileged user creating a computer account, rapid modification of that computer object's dNSHostName or servicePrincipalName attributes, a certificate request for a machine/client-authentication template, and subsequent Kerberos ticket activity that appears to authenticate as a domain controller or other high-value computer account. Review domain controller Security logs for Event ID 4741 computer-account creation, Event ID 4742 computer-account changes, Event ID 5136 directory object modifications, Event ID 4768 Kerberos TGT requests, and Event ID 4769 service-ticket requests. Review AD CS logs for Event ID 4886 certificate requests and Event ID 4887 certificate issuance, especially where the requester is newly created, unusual, or tied to a computer account whose hostname attributes recently changed. Investigate changes to ms-DS-MachineAccountQuota and unexpected delegation of rights allowing computer-account creation. Examine certificate authority databases for machine certificates issued to names resembling domain controllers or Tier 0 systems. Search endpoint and administrative logs for known offensive tooling and command patterns associated with AD CS abuse, including Certipy, Certify, Rubeus, Impacket, and requests using machine templates. If exploitation is suspected, perform domain-wide hunting for DCSync indicators, unexpected replication permissions, new privileged group members, new computer objects, modified Group Policy Objects, abnormal logons by machine accounts, and persistence via certificates that may remain valid after patching.

• Event ID 4741
• Event ID 4742
• Event ID 5136
• Event ID 4768
• Event ID 4769
• Event ID 4886
• Event ID 4887
• dNSHostName
• servicePrincipalName
• ms-DS-MachineAccountQuota
• CertificateTemplate: Machine
• Certificate Template: Machine
• CertificateTemplate: Computer
• Certificate Template: Computer
• Certipy
• certipy
• Certify.exe
• Rubeus.exe
• gettgtpkinit.py
• PKINIT
• DCSync
• lsadump::dcsync
• DRSGetNCChanges
• Directory Service Changes
• A computer account was created
• A computer account was changed
• Certificate Services received a certificate request
• Certificate Services approved a certificate request and issued a certificate

What your security team should do

• Immediately verify remediation status because this vulnerability is in CISA KEV, is known to be exploited in the wild, and the CISA due date of 2022-09-08 has long passed.
• Prioritize patching and verification on domain controllers and Active Directory Certificate Services servers before lower-risk systems.
• Inventory all enterprise certificate authorities, enabled certificate templates, and enrollment permissions; remove or restrict templates that are not business-critical.
• Set ms-DS-MachineAccountQuota to 0 or an explicitly justified minimal value, then delegate computer-account creation through controlled administrative workflows.
• Hunt for suspicious chains involving computer-account creation, dNSHostName or servicePrincipalName changes, certificate issuance, and Kerberos authentication from unusual hosts or accounts.
• Enable and retain advanced audit logs for directory service changes, account management, Kerberos authentication, and AD CS certificate issuance events.
• Review recently issued machine certificates for names matching domain controllers or other Tier 0 assets, especially where the requester was a newly created or unusual computer account.
• Investigate any signs of DCSync, unauthorized replication rights, unexpected privileged group membership changes, or new persistence mechanisms after suspected exploitation.
• Restrict network access to certificate enrollment interfaces and domain controller services to approved administrative and domain-joined systems where feasible.
• Run an AD CS exposure assessment using trusted internal tooling or manual review, and treat exploitable AD CS misconfigurations as domain-compromise risks.