Security readout for executives and security teams
Plain-English summary
CVE-2022-26923 is a high-severity Microsoft Active Directory Domain Services privilege-escalation issue. A low-privileged attacker on the network could potentially gain powerful domain-level impact. It is listed in CISA KEV, so organizations should treat it as known exploited and verify remediation on affected Windows Server and Windows client systems.
Executive priority
Treat as urgent for any Active Directory environment. Known exploitation plus domain privilege impact means delayed remediation can create enterprise-wide compromise risk, especially where domain controllers remain unpatched.
Technical view
The source bundle identifies AD DS elevation of privilege with CVSS 8.8, AV:N/AC:L/PR:L/UI:N, and high confidentiality, integrity, and availability impact. CWE-295 indicates certificate validation weakness. Microsoft lists official remediation, and affected platforms include Windows Server 2012 R2 through 2022 and multiple Windows client versions.
Likely exposure
Exposure is most relevant to environments using Microsoft Active Directory Domain Services on listed Windows Server versions. The bundle also lists several Windows client versions, so asset inventory should confirm all affected Windows builds and domain roles.
Exploitation context
CISA KEV inclusion supports active exploitation. The bundle does not provide exploit mechanics, observed campaigns, or required environmental preconditions beyond network access, low privileges, no user interaction, and affected Microsoft AD DS platforms.
Researcher notes
Evidence is strong for severity, affected Microsoft platforms, official remediation availability, and KEV status. The provided bundle does not include detailed root-cause analysis, exploit prerequisites beyond CVSS, or detection logic, so validation should rely on Microsoft and CISA guidance.
Mitigation direction
- Apply Microsoft security updates for CVE-2022-26923 to affected Windows systems.
- Prioritize domain controllers and AD DS infrastructure first.
- Check Microsoft guidance for any post-update configuration requirements.
- Review CISA KEV deadlines and internal remediation SLAs.
- Monitor domain authentication and privilege changes for suspicious activity.
Validation and detection
- Inventory listed Windows Server and Windows client versions.
- Confirm May 2022 or later applicable Microsoft updates are installed.
- Verify domain controllers are included in patch compliance reporting.
- Check vulnerability scanners reference CVE-2022-26923 as remediated.
- Review AD security logs for unusual privilege escalation indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-26923 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- Active Directory Domain Services Elevation of Privilege VulnerabilityCVE reference · vendor-advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26923CVE reference · x_refsource_MISC, x_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26923CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Certificate Validation
Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.