Active Directory Domain Services Elevation of Privilege Vulnerability
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An attacker with a basic user account, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
Active Directory Domain Services Elevation of Privilege Vulnerability
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
To mitigate risk, enable Extended Protection for Authentication (EPA) on Active Directory Certificate Services (AD CS) web enrollment and certificatenamemapping services. Implement strong NTLM relay protections across the domain, such as enforcing SMB signing where practical and monitoring for NTLM authentication to critical services like AD CS. Restrict network access to AD CS to only necessary administrative machines and users.
The permanent resolution is to apply the security updates released by Microsoft for CVE-2022-26923. Administrators should prioritize patching all affected Active Directory Domain Controllers and Active Directory Certificate Services (AD CS) servers. These updates address the underlying vulnerability by securing how AD CS processes authentication and certificate requests.
An attacker can exploit this vulnerability to elevate privileges from a standard domain user to a domain administrator. This grants them full control over the Active Directory domain, allowing for arbitrary code execution, data exfiltration, and the creation of new privileged accounts. The business consequences include severe data breaches, complete network compromise, and significant operational disruption.
Other CVEs affecting windows 10 1507
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
HTTP Protocol Stack Remote Code Execution Vulnerability
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032, CVE-2020-1036, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043.