CVE-2022-37958

What it actually does

This vulnerability affects Microsoft Windows SPNEGO Extended Negotiation (NEGOEX), a security mechanism used during authentication negotiation. A remote, unauthenticated attacker can trigger memory corruption in the NEGOEX processing path by sending specially crafted authentication negotiation data to a Windows system or service that processes SPNEGO/NEGOEX tokens. Successful exploitation can result in remote code execution in the security context of the affected service or process, potentially allowing the attacker to run arbitrary code, access sensitive data, modify system state, or disrupt availability. The CVSS vector indicates network reachability, no required privileges, no user interaction, and high confidentiality, integrity, and availability impact, but with high attack complexity.

Why it matters to the business

If exploited, this flaw could allow an attacker to compromise Windows workstations or servers through exposed authentication-handling services, creating a path to data theft, lateral movement, service disruption, or full system takeover depending on the targeted service context. Because the affected product set spans many supported and legacy Windows client and server versions, organizations with broad Windows estates may have significant exposure if systems are not consistently patched. Although it is not listed in CISA KEV and no ransomware use is indicated in the provided data, the EPSS score is high, so remediation should be prioritized for internet-facing systems, domain infrastructure, file/application servers, and systems that accept inbound authentication requests.

How an attack unfolds

An attacker first identifies Windows hosts or services that accept network authentication using SPNEGO/NEGOEX, such as services that rely on Windows integrated authentication. The attacker then initiates an authentication negotiation and sends a crafted NEGOEX token designed to trigger the vulnerable parsing or negotiation logic. If the exploit succeeds, memory corruption occurs before authentication is completed, allowing code execution without valid credentials. The attacker may then execute commands or payloads in the context of the vulnerable service, establish persistence, dump credentials, access local data, or pivot to other systems. Exploitation is considered high complexity, so reliable attacks may require precise knowledge of the target service behavior, Windows build, memory layout, or environmental conditions.

How to fix it

Apply the Microsoft security updates released for CVE-2022-37958 to all affected Windows versions, including Windows 10, Windows 11, Windows 7, Windows 8.1, Windows Server 2008, Windows Server 2012, Windows Server 2016, Windows Server 2019, and Windows Server 2022 where applicable. Because no package-specific fixed versions were provided, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, or other patch management tooling to confirm the applicable cumulative update or security-only update for each Windows release and build. Prioritize systems that expose authentication services to untrusted networks, domain controllers, remote access infrastructure, application servers using Windows Integrated Authentication, and legacy unsupported Windows systems. Where immediate patching is not possible, reduce exposure by restricting inbound access to affected services, segmenting Windows servers, disabling unnecessary services that accept SPNEGO authentication, enforcing host firewalls, and monitoring authentication negotiation anomalies. Unsupported operating systems should be upgraded, isolated, or protected with compensating controls.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows host has the Microsoft security update for CVE-2022-37958 installed or is running a cumulative update that supersedes it. Use enterprise patch management inventory, Windows Update history, Microsoft Update Catalog applicability data, or vulnerability scanning authenticated to the host to validate patch state. Check the OS build and installed hotfix list using supported administrative tools such as Settings > Windows Update, Control Panel update history, PowerShell Get-HotFix, Windows Management Instrumentation, or Microsoft Defender Vulnerability Management. Validate exposure reduction by confirming that only required services accepting Windows Integrated Authentication are reachable from trusted networks and that host firewalls or network ACLs block unnecessary inbound access. Retest with a vulnerability scanner that explicitly checks for the Microsoft bulletin associated with this vulnerability rather than relying only on port exposure.

Typical attack path

1. Scan for Windows systems or services that accept inbound authentication using SPNEGO or Windows Integrated Authentication.
2. Initiate a network authentication negotiation with the target service.
3. Send a specially crafted SPNEGO/NEGOEX authentication token to trigger the vulnerable NEGOEX processing path.
4. Achieve remote code execution in the context of the affected service or process if exploitation succeeds.
5. Run post-exploitation commands, deploy tools, dump credentials, or stage additional payloads.
6. Use the compromised host for lateral movement, privilege escalation, persistence, or data access.

How to detect it

To assess possible prior exploitation, review Windows event logs, service logs, EDR telemetry, crash dumps, and network authentication traces for abnormal activity involving SPNEGO, NEGOEX, SSPI, LSASS, and services that accept Windows Integrated Authentication. Focus on the period before patch deployment and on systems with exposed authentication services. Look for repeated failed or malformed authentication attempts, service crashes or restarts immediately after authentication negotiation, Windows Error Reporting events involving authentication-related components, unexpected child processes spawned by network-facing services, and suspicious post-exploitation behavior such as credential dumping, new services, scheduled tasks, or unusual outbound connections. Relevant log sources include Windows Security logs, System logs, Application logs, Microsoft-Windows-Security-Auditing events, Microsoft-Windows-Windows Error Reporting, EDR process telemetry, web server logs for Windows Integrated Authentication endpoints, SMB/RPC service telemetry, firewall logs, and network IDS/packet captures containing SPNEGO/NEGOEX negotiation data. Because the provided intelligence does not include a public exploit signature or known campaign artifact, detection should combine protocol anomaly monitoring with endpoint behavioral detection for code execution after authentication negotiation.

• NEGOEX
• SPNEGO
• 1.3.6.1.5.5.2
• Event ID 1000
• Event ID 1001
• Faulting application name: lsass.exe
• Faulting module name: negoexts.dll
• Faulting module name: secur32.dll
• Faulting module name: sspicli.dll
• Windows Error Reporting
• wermgr.exe
• werfault.exe
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• rundll32.exe
• regsvr32.exe
• certutil.exe -urlcache
• bitsadmin.exe
• schtasks /create
• sc create
• procdump.exe -ma lsass.exe
• comsvcs.dll, MiniDump

What your security team should do

• Prioritize patch deployment for internet-facing Windows services, domain controllers, remote access servers, web servers using Windows Integrated Authentication, and high-value Windows servers.
• Run authenticated vulnerability scans across all Windows client and server assets to identify missing Microsoft security updates for CVE-2022-37958.
• Investigate legacy Windows 7, Windows 8.1, Windows Server 2008, and Windows Server 2012 assets for support status and isolate or retire systems that cannot receive updates.
• Restrict inbound access to services that accept SPNEGO or Windows Integrated Authentication to trusted network segments only.
• Review authentication and service logs for anomalous negotiation failures, crashes, or unexpected process launches around authentication-handling services.
• Monitor for exploitation attempts despite the absence of CISA KEV listing, because the EPSS score indicates elevated likelihood of exploitation activity.
• Ensure endpoint detection and response coverage is active on Windows servers and configured to alert on suspicious child processes spawned by network-facing services.
• Document patch exceptions and apply compensating controls such as segmentation, host firewall rules, and enhanced logging until remediation is complete.