CVE-2022-26923
Active Directory Domain Services Elevation of Privilege Vulnerability
KEVHIGH 8.8EPSS 83.5%
Active Directory Domain Services Elevation of Privilege Vulnerability
- Affected
- Microsoft · Windows 10 Version 1809 · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1909 · Windows 10 Version 21H1 · Windows Server 2022
- CVSS v3.1 MICROSOFT
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 9.0 HIGH
AV:N/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 83.50% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2022-08-18
- Published
- 2022-05-10
- Updated
- 2025-10-21
Proof-of-concept exploits (8)
- Gh-Badr/CVE-2022-269232★ · 2023-12-09
- LudovicPatho/CVE-2022-26923_AD-Certificate-Services41★ · 2022-05-14
- Yowise/CVE-2022-269230★ · 2024-09-01
- lsecqt/CVE-2022-26923-Powershell-POC17★ · 2022-08-17
- r1skkam/TryHackMe-CVE-2022-269236★ · 2022-05-12
- rayngnpc/CVE-2022-26923-rayng0★ · 2025-03-04
- Eliasdekiniweek/CVE-2022-269231★ · 2026-02-21
- Nefhara/CVE-2022-269230★ · 2026-05-29
Metasploit modules (1)
Security advisories
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26923
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26923