Threat Brief: Microsoft Critical Vulnerabilities (CVE-2022-26809, CVE-2022-26923, CVE-2022-26925)
Summary: Microsoft released patches for three critical Windows vulnerabilities in its April and May 2022 security updates: CVE-2022-26809, a severe RPC flaw that could allow remote code execution against the Windows SMB service, CVE-2022-26923, which lets a low-privileged user escalate to domain administrator in a default Active Directory environment with the Active Directory Certificate Services server role installed, and CVE-2022-26925, an LSARPC flaw an unauthenticated attacker could use to coerce domain controller authentication via NTLM. All three vulnerabilities and exploit details are publicly available, and CVE-2022-26925 was detected as being exploited in the wild.
What you should know: CVE-2022-26923 turns a low-privileged user into a domain administrator in a default Active Directory environment with Certificate Services installed, and CVE-2022-26925 is already being exploited in the wild. The vulnerable rpcrt4.dll is used not only by Microsoft services but by other applications, so the exposure extends beyond the Windows SMB service.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-26809CVE-2022-26923CVE-2022-26925
- Related
- CVE-2022-26923: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Aug 18, 2022CVE-2022-26925: Microsoft Windows LSA Spoofing Vulnerability Known Exploited Vulnerabilities · Jul 01, 2022