CVE-2022-26925

What it actually does

CVE-2022-26925 is a Windows Local Security Authority (LSA) spoofing flaw that can allow an unauthenticated network attacker to coerce or manipulate Windows authentication flows and relay NTLM authentication to another service. In practical enterprise scenarios, the risk is highest in Active Directory environments where NTLM is still enabled and services such as Active Directory Certificate Services or other NTLM-accepting endpoints are reachable. Successful exploitation can let an attacker impersonate a privileged machine or user context to obtain unauthorized access, issue certificates, or perform actions as the relayed identity. The vulnerability affects a broad range of Windows client and server versions, including Windows 7 through Windows 11 and Windows Server 2008 through Server 2022.

Why it matters to the business

This vulnerability can undermine trust in Windows domain authentication and may allow attackers to escalate access inside an enterprise network without needing valid credentials. If exploited against domain controllers or certificate infrastructure, it can lead to domain compromise, unauthorized certificate issuance, persistent access, and disruption of identity-dependent business operations. The vulnerability is listed in CISA KEV with a remediation due date of 2022-07-22 and has active exploitation in the wild, so unpatched or weakly configured Windows environments should be treated as high priority despite the moderate CVSS score.

How an attack unfolds

An attacker with network access to Windows systems identifies an environment where NTLM authentication is permitted and where a valuable target, such as a domain controller or certificate enrollment endpoint, accepts relayed authentication. The attacker triggers a vulnerable LSA-related authentication behavior so that a Windows host authenticates outward using NTLM. Instead of cracking credentials, the attacker relays that authentication to another internal service that trusts NTLM. If the relayed identity has sufficient privileges, the attacker can gain unauthorized access, request certificates, impersonate the victim identity, or pivot deeper into Active Directory. In real-world attacks, this class of issue is commonly combined with NTLM relay tooling and misconfigured AD CS or other NTLM-enabled services.

How to fix it

Apply the Microsoft security updates released for CVE-2022-26925 to all affected Windows clients and servers, prioritizing domain controllers, certificate servers, file servers, management servers, and internet- or partner-accessible Windows systems. Because no exact per-product fixed versions were provided, use Microsoft’s official update guidance for each supported Windows release and verify that May 2022 or later cumulative security updates, or their superseding updates, are installed. Reduce exposure by disabling NTLM where possible, restricting NTLM usage through Group Policy, enforcing SMB signing, enforcing LDAP signing and LDAP channel binding, enabling Extended Protection for Authentication on IIS/AD CS endpoints, and auditing or removing legacy NTLM-dependent applications. For AD CS, review certificate templates, enrollment permissions, and web enrollment endpoints to ensure relayed authentication cannot result in unauthorized certificate issuance.

How to confirm the fix worked

Confirm that all affected Windows assets have the relevant Microsoft cumulative security update or later installed. Validate patch coverage using enterprise patch management, Windows Update history, endpoint inventory, or vulnerability scanning authenticated to the host. On domain controllers and certificate servers, verify hardening controls: NTLM restrictions are configured, SMB signing is required where appropriate, LDAP signing/channel binding are enforced or audited before enforcement, and IIS endpoints that accept Windows authentication use Extended Protection for Authentication. Test exposure defensively by confirming that anonymous or coerced LSA-related authentication paths are blocked and that NTLM relay attempts fail against LDAP, SMB, and AD CS services. Review AD CS issuance logs to ensure no unexpected certificates were issued to machine accounts, domain controllers, administrators, or high-privilege users.

Typical attack path

1. Gain network reachability to Windows hosts and domain services.
2. Identify NTLM-enabled services that do not enforce relay protections such as SMB signing, LDAP signing/channel binding, EPA, or HTTPS protections.
3. Trigger the Windows LSA spoofing condition to induce authentication from a target system or account.
4. Relay the captured NTLM authentication to a sensitive internal service such as LDAP, SMB, HTTP, or AD CS certificate enrollment.
5. Use the relayed identity to perform an unauthorized action, such as obtaining access, changing directory state, or requesting a certificate.
6. Use the resulting access or certificate material to impersonate users or machines and expand control within the Windows domain.

How to detect it

Look for evidence of NTLM relay, coerced authentication, and abnormal certificate enrollment activity around domain controllers, Windows servers, and AD CS infrastructure. Useful log sources include Windows Security logs on domain controllers and member servers, Microsoft-Windows-NTLM operational logs, Microsoft-Windows-SMBServer logs, Directory Service logs, AD CS Certificate Services events, IIS logs for certificate enrollment endpoints, firewall/proxy logs, EDR telemetry, and network detections for RPC/SMB/HTTP NTLM authentication. Review Windows Security Event ID 4624 for network logons using NTLM, especially from unusual source hosts, with Account Name values such as ANONYMOUS LOGON or machine accounts authenticating to unexpected destinations. Review Event ID 4776 for NTLM authentication spikes or failures, and AD CS events such as 4886 and 4887 for unusual certificate requests and issuances. In IIS logs, look for unexpected POST requests to AD CS web enrollment paths, particularly from non-administrative workstations or systems that normally do not request certificates. Investigate signs of relay tools, including process names, command-line remnants, Python-based tooling on endpoints, suspicious inbound SMB/RPC connections, and authentication chains where a system authenticates to an attacker-controlled host followed immediately by access to LDAP, SMB, HTTP, or certificate services.

• \\PIPE\\lsarpc
• lsarpc
• ANONYMOUS LOGON
• Logon Process: NtLmSsp
• Authentication Package: NTLM
• Event ID 4624
• Event ID 4776
• Event ID 4886
• Event ID 4887
• /certsrv/certfnsh.asp
• /certsrv/certnew.cer
• /certsrv/
• POST /certsrv/certfnsh.asp
• POST /certsrv/
• ntlmrelayx
• ntlmrelayx.py
• impacket-ntlmrelayx
• Impacket
• Certipy
• certipy
• Coercer
• PetitPotam
• EfsRpcOpenFileRaw
• MS-RPC LSARPC
• NTLMSSP_NEGOTIATE
• NTLMSSP_AUTH
• Microsoft-Windows-NTLM/Operational
• Microsoft-Windows-SmbServer/Security

What your security team should do

• Immediately verify patch status for all Windows domain controllers, certificate authorities, and high-value servers; remediate any gaps first.
• Treat unpatched systems as potentially exposed because this vulnerability is in CISA KEV and has been exploited in the wild.
• Audit and reduce NTLM usage; prioritize disabling NTLM where business applications permit.
• Enforce SMB signing, LDAP signing, LDAP channel binding, and Extended Protection for Authentication on services that accept Windows authentication.
• Review Active Directory Certificate Services configuration for vulnerable templates, overly broad enrollment rights, and exposed web enrollment endpoints.
• Search historical logs for signs of NTLM relay, unexpected certificate issuance, anonymous LSA/RPC access, and suspicious authentication from domain controllers or servers.
• Investigate any unexpected certificates issued to privileged users, machine accounts, or domain controllers and revoke suspicious certificates.
• Monitor for common relay tooling indicators such as Impacket ntlmrelayx, Certipy, Coercer-style activity, and unusual LSARPC traffic.
• If compromise is suspected, perform Active Directory incident response, including certificate authority review, privileged credential rotation, and Kerberos/NTLM authentication timeline analysis.