Active Directory Domain Services Privilege Escalation Vulnerability (CVE-2022-26923) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTAll Windows Server Domain Controllers in environments where Active Directory Certificate Services (ADCS) is enabled.
A low-privileged domain user can obtain a certificate for the Domain Controller's computer account, leading to full Domain Admin privilege escalation.
Apply the official Microsoft cumulative security updates and harden the dNSHostName mapping validation on ADCS.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the May 10, 2022 cumulative security update (or later) to all Domain Controllers in the forest to enforce strong certificate mapping.
You can use the following PowerShell commands to install the required cumulative update (e.g., KB5013944 or equivalent for your OS version):
# Install Windows Update module and apply the security update
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -KBArticleID KB5013944 -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, restrict standard users from creating machine accounts by setting the 'ms-DS-MachineAccountQuota' attribute to '0'.
Execute the following PowerShell command on a Domain Controller to modify the quota:
# Import Active Directory module and set Machine Account Quota to 0
Import-Module ActiveDirectory
Set-ADDomain (Get-ADDomain) -Replace @{'ms-DS-MachineAccountQuota'=0}
# Verify the configuration change
(Get-ADDomain).'ms-DS-MachineAccountQuota'3. Log Audit & IoC Verification Commands
Monitor Domain Controller security event logs for Event ID 4741 (Computer Account Created) and Event ID 4742 (Computer Account Changed) to detect unauthorized modifications of the dNSHostName attribute.
Use this PowerShell script to scan for suspicious computer account modifications over the last 7 days:
# Scan Security Logs for Event ID 4742 with suspicious dNSHostName modifications
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4742; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
foreach ($Event in $Events) {
$Xml = [xml]$Event.ToXml()
$TargetName = ($Xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
$DnsName = ($Xml.Event.EventData.Data | Where-Object {$_.Name -eq 'DnsHostName'}).'#text'
$SubjectName = ($Xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
if ($DnsName -and ($DnsName -like '*dc*' -or $DnsName -like '*ad*')) {
Write-Host '[WARNING] Suspect Computer Account Modification Detected!' -ForegroundColor Red
Write-Host 'Target Account:' $TargetName
Write-Host 'Modified DNS Host Name:' $DnsName
Write-Host 'Actor Account:' $SubjectName
Write-Host '--------------------------------------------------'
}
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the interaction between Active Directory Domain Services (AD DS) and Active Directory Certificate Services (AD CS). By default, authenticated domain users are permitted to join up to 10 machine accounts to the domain. A flaw in the validation of the 'dNSHostName' attribute allows an attacker to register a newly created machine account with a dNSHostName that matches the FQDN of a Domain Controller. Because AD CS relies on this attribute to determine the identity for Subject Alternative Names (SAN) during certificate enrollment, it leads to improper certificate validation (CWE-295).
2. Exploitation Mechanics & Attack Scenario
An attacker can compromise the entire Active Directory forest using the following steps:
- Machine Account Creation: The attacker registers a new machine account (e.g., 'FakeDC$') using standard domain user credentials.
- Attribute Manipulation: The attacker modifies the 'dNSHostName' attribute of the new machine account to match the target Domain Controller's FQDN (e.g., 'dc01.corp.local'), bypassing SPN conflicts by clearing or modifying conflicting attributes.
- Certificate Request: The attacker requests a certificate from AD CS using the 'Machine' template. AD CS issues a certificate containing the identity of the Domain Controller based on the spoofed dNSHostName.
- Privilege Escalation: The attacker uses the issued certificate to perform Kerberos PKINIT authentication, obtaining a Ticket Granting Ticket (TGT) for the Domain Controller, thereby gaining full Domain Admin privileges.
3. Infrastructure & Business Impact
With a CVSS score of 8.8 and its inclusion in the CISA KEV catalog, this vulnerability represents a severe threat actively exploited in the wild. Successful exploitation allows any insider or compromised low-privileged account to instantly escalate to Domain Administrator. This results in a complete compromise of the Active Directory infrastructure, enabling attackers to deploy ransomware, exfiltrate sensitive data, and establish persistent backdoors across the entire enterprise network.
Official Vendor Advisories & References
Active Directory Domain Services Elevation of Privilege Vulnerability
Frequently Asked SecOps Questions (CVE-2022-26923)
FAQQ1. How critical is CVE-2022-26923 and is it actively exploited in the wild?
CVE-2022-26923 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 83.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-26923?
Primary impacted vendors include microsoft across active directory domain services, windows server. Scope summary: All Windows Server versions (2008 through 2022) configured as Domain Controllers in environments utilizing Active Directory Certificate Services (AD CS)
Q3. What temporary mitigations or workarounds exist for CVE-2022-26923 before patching?
[Mitigation] Apply the official Microsoft cumulative security updates and harden the dNSHostName mapping validation on ADCS. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-26923
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Microsoft Active Directory Federation Services (AD FS) Privilege Escalation Vulnerability (CVE-2026-56155) Security Advisory
[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.