{"id":"CVE-2022-26925","kind":"vulnerability","aliases":["CVE-2022-26925"],"related":[],"title":"Windows LSA Spoofing Vulnerability","description":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.\n\nCISA required action: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].","summary":"Windows Local Security Authority (LSA) can be coerced into spoofing, which makes a domain controller authenticate to an attacker using NTLM. The attacker can capture or relay those credentials to act as the domain controller's account.","severity":"high","cvss":8.1,"epss":0.10476,"exploited":true,"exploited_at":"2022-07-01T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":["10.0.10240.19297"],"affected":"< 10.0.10240.19297","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.5125"],"affected":"< 10.0.14393.5125","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.2928"],"affected":"< 10.0.17763.2928","ecosystem":"vendor"},{"name":"microsoft windows 10 1909","fixed":["10.0.18363.2274"],"affected":"< 10.0.18363.2274","ecosystem":"vendor"},{"name":"microsoft windows 10 20h2","fixed":["10.0.19042.1706"],"affected":"< 10.0.19042.1706","ecosystem":"vendor"},{"name":"microsoft windows 10 21h1","fixed":["10.0.19043.1706"],"affected":"< 10.0.19043.1706","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.1706"],"affected":"< 10.0.19044.1706","ecosystem":"vendor"},{"name":"microsoft windows 11 21h2","fixed":["10.0.22000.675"],"affected":"< 10.0.22000.675","ecosystem":"vendor"},{"name":"microsoft windows 7","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 8.1","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows rt 8.1","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.5125"],"affected":"< 10.0.14393.5125","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.2928"],"affected":"< 10.0.17763.2928","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.707"],"affected":"< 10.0.20348.707","ecosystem":"vendor"},{"name":"microsoft windows server 20h2","fixed":["10.0.19042.1706"],"affected":"< 10.0.19042.1706","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["active-directory","domain-controller","exploited","infrastructure","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the remediation actions in the CISA guidance linked in the sources (https://www.cisa.gov/guidance-applying-june-microsoft-patch). The sources do not name a patched build.","status":"open","published_at":"2022-05-10T21:15:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:31+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:12:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the remediation actions in the CISA guidance linked in the sources (https://www.cisa.gov/guidance-applying-june-microsoft-patch). The sources do not name a patched build.","reach":"network","impact":"high","summary":"Windows Local Security Authority (LSA) can be coerced into spoofing, which makes a domain controller authenticate to an attacker using NTLM. The attacker can capture or relay those credentials to act as the domain controller's account.","category":"infrastructure","who_cares":["windows","active-directory","domain-controller"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker relays domain controller NTLM authentication and takes over domain identity","analyst_note":"Confirm the patched Windows builds, any required hardening (NTLM restriction, SMB signing, LDAP signing), and whether the patch was later changed, in Microsoft's advisory for CVE-2022-26925 and the CISA guidance URL above.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000851,"input_tokens":2874,"output_tokens":1127,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':6A,9A '-26925':7A,10A '/guidance-applying-june-microsoft-patch].':170C '10':15A,19A,23A,27A,31A,35A,39A '11':43A '1507':16A '1607':20A '1809':24A '1909':28A '2008':58A,62A '2012':66A,70A '2016':74A '2019':78A '2022':82A '20h2':32A,86A '21h1':36A '21h2':40A,44A '7':47A '8.1':50A,54A 'account':132B 'act':126B 'action':160C,163C 'activ':88B 'active-directori':87B 'appli':161C 'attack':114B,118B,145C,155C 'authent':111B,152C 'author':99B,137C 'captur':120B 'cisa':158C,166C 'coerc':103B,147C 'contain':139C 'control':92B,110B,130B,150C 'credenti':124B 'cve':5A,8A 'directori':89B 'domain':91B,109B,129B,149C 'domain-control':90B 'exploit':93B 'guidanc':167C 'infrastructur':94B 'local':97B,135C 'lsa':2A,100B,138C 'make':107B 'microsoft':11A,13A,17A,21A,25A,29A,33A,37A,41A,45A,48A,51A,55A,59A,63A,67A,71A,75A,79A,83A,133C 'ntlm':116B,157C 'outlin':164C 'relay':122B 'remedi':162C 'requir':159C 'rt':53A 'secur':98B,136C 'server':57A,61A,65A,69A,73A,77A,81A,85A 'spoof':3A,105B,141C 'use':115B,156C 'vulner':4A,142C 'window':1A,95B,96B,134C 'windows':12A,14A,18A,22A,26A,30A,34A,38A,42A,46A,49A,52A,56A,60A,64A,68A,72A,76A,80A,84A 'www.cisa.gov':169C 'www.cisa.gov/guidance-applying-june-microsoft-patch].':168C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-05-10T21:15:10+00:00","kev":{"dateAdded":"2022-07-01","dueDate":"2022-07-22","requiredAction":"Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-26925","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26925","severity":null,"published_at":"2022-07-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2022-26925","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26925","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-26925","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26925","severity":null,"published_at":"2022-05-10T21:15:10+00:00","modified_at":"2026-06-17T04:36:08+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}