PT-2022-2476 · Microsoft · Active Directory Domain Services+2

Ly4K · Published 2022-05-10 · Updated 2026-03-31 · CVE-2022-26923

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

High

AV:N/AC:L/Au:S/C:C/I:C/A:C

Active Directory Domain Services and Certificate Services (affected versions not specified)

Description: This issue involves an elevation of privilege vulnerability affecting Active Directory Domain Services and Certificate Services. Successful exploitation allows attackers to impact the system and potentially gain control of the domain. The vulnerability stems from improper authorization within the certificate services, enabling attackers to create machine accounts and perform Kerberoasting attacks to extract service account credentials from domain controllers. Exploitation requires authentication and involves manipulating certificate requests to obtain certificates with elevated privileges. Recent reports indicate that cybercriminals are actively exploiting this issue, often in conjunction with social engineering tactics, to compromise systems and escalate privileges. The vulnerability, also known as "Certifried," allows attackers to add a computer to the domain and subsequently extract NTLM hashes, potentially leading to domain takeover. Several sophisticated intrusion attempts have been linked to this vulnerability, with attackers adapting their techniques to bypass security measures.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Improper Certificate Validation

Improper Privilege Management

Weakness Enumeration

CWE-295

CWE-269

Related Identifiers

BDU:2022-02883

CVE-2022-26923

ZDI-22-729

Affected Products

Active Directory Domain Services

Windows Active Directory Certificate Services

Windows

References · 75

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb · Exploit
• 🔥 https://github.com/evilashz/PIGADVulnScanner · Exploit
• 🔥 https://github.com/LudovicPatho/CVE-2022-26923_AD-Certificate-Services · Exploit
• 🔥 https://github.com/lsecqt/CVE-2022-26923-Powershell-POC · Exploit
• 🔥 https://github.com/r1skkam/TryHackMe-CVE-2022-26923 · Exploit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-26923 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02883 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-26923 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-729 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-26923 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26923 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26923 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26923 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26923 · Security Note
• https://t.me/poxek/1525 · Telegram Post