Live › vulnerability › CVE-2022-26925
Go to dashboardWindows Local Security Authority (LSA) can be coerced into spoofing, which makes a domain controller authenticate to an attacker using NTLM. The attacker can capture or relay those credentials to act as the domain controller's account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Windows | vendor | – | – |
| microsoft windows 10 1507 | vendor | < 10.0.10240.19297 | 10.0.10240.19297 |
| microsoft windows 10 1607 | vendor | < 10.0.14393.5125 | 10.0.14393.5125 |
| microsoft windows 10 1809 | vendor | < 10.0.17763.2928 | 10.0.17763.2928 |
| microsoft windows 10 1909 | vendor | < 10.0.18363.2274 | 10.0.18363.2274 |
| microsoft windows 10 20h2 | vendor | < 10.0.19042.1706 | 10.0.19042.1706 |
| microsoft windows 10 21h1 | vendor | < 10.0.19043.1706 | 10.0.19043.1706 |
| microsoft windows 10 21h2 | vendor | < 10.0.19044.1706 | 10.0.19044.1706 |
| microsoft windows 11 21h2 | vendor | < 10.0.22000.675 | 10.0.22000.675 |
| microsoft windows 7 | vendor | – | – |
| microsoft windows 8.1 | vendor | – | – |
| microsoft windows rt 8.1 | vendor | – | – |
| microsoft windows server 2008 | vendor | – | – |
| microsoft windows server 2008 | vendor | = r2 | – |
| microsoft windows server 2012 | vendor | – | – |
| microsoft windows server 2012 | vendor | = r2 | – |
| microsoft windows server 2016 | vendor | < 10.0.14393.5125 | 10.0.14393.5125 |
| microsoft windows server 2019 | vendor | < 10.0.17763.2928 | 10.0.17763.2928 |
| microsoft windows server 2022 | vendor | < 10.0.20348.707 | 10.0.20348.707 |
| microsoft windows server 20h2 | vendor | < 10.0.19042.1706 | 10.0.19042.1706 |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.
CISA required action: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
This page as .md · .json · in your agent: get_signal("CVE-2022-26925")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.