CVE-2022-26923
KEVMicrosoft Active Directory Domain Services Privilege Escalation Vulnerability
View CVE record →- Vendor / Project
- Microsoft
- Product
- Active Directory
- Date added
- Aug 18, 2022
- Due date
- Sep 8, 2022
- Known ransomware use
- Unknown
- CWEs
- CWE-295
Description
An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.
Required action
Apply updates per vendor instructions.