Windows LSA Spoofing and NTLM Relay Vulnerability (CVE-2022-26925) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTWindows and Windows Server operating systems, specifically Active Directory Domain Controllers
Unauthenticated remote attackers can call methods on the LSARPC interface to coerce the Domain Controller to authenticate to an arbitrary target via NTLM, leading to full domain takeover
Apply the official Microsoft cumulative security updates immediately, and enforce Extended Protection for Authentication (EPA) along with SMB signing to block NTLM relay paths
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official Microsoft cumulative security updates. To check and install the required updates on Windows Server via PowerShell, execute the following commands:
# Install Windows Update module and apply the security updates
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -KBArticleID KB5013944, KB5013941 -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, mitigate NTLM relay vectors by enforcing Extended Protection for Authentication (EPA) on AD CS IIS endpoints. Use the following PowerShell commands to configure EPA on the CertSrv virtual directory:
# Load IIS Web Administration module
Import-Module WebAdministration
# Enable Windows Authentication and enforce EPA on AD CS CertSrv
Set-WebConfigurationProperty -Filter '/system.webServer/security/authentication/windowsAuthentication' -Name 'useKernelMode' -Value $true -PSPath 'IIS:\sites\Default Web Site\CertSrv'
Set-WebConfigurationProperty -Filter '/system.webServer/security/authentication/windowsAuthentication' -Name 'extendedProtection.tokenChecking' -Value 'Require' -PSPath 'IIS:\sites\Default Web Site\CertSrv'3. Log Audit & IoC Verification Commands
Monitor Windows Security Event Logs for Event ID 4624 to detect anomalous NTLM authentication attempts or anonymous logons originating from LSARPC coercion. Run the following script to audit NTLM authentications over the last 24 hours:
# Query Security Event Logs for NTLM authentication events in the last 24 hours
$StartDate = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{
LogName = 'Security'
Id = 4624
StartTime = $StartDate
} | Where-Object { $_.Properties.Value -eq 'NtLmSsp' } | Select-Object TimeCreated, Id, @{N='TargetUser';E={$_.Properties.Value}}, @{N='IpAddress';E={$_.Properties.Value}} | Format-Table -AutoSizeBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is an LSA (Local Security Authority) spoofing flaw arising from a lack of proper authentication validation within the LSARPC interface (CWE-306). An unauthenticated attacker can issue specific RPC calls to force a target system (such as a Domain Controller) to initiate an outbound NTLM authentication request to an attacker-controlled server.
2. Exploitation Mechanics & Attack Scenario
An attacker establishes an RPC connection to the Domain Controller and invokes vulnerable LSARPC functions. Once the Domain Controller attempts to authenticate back to the attacker's listener, the attacker intercepts and relays this NTLM credential to another internal service that accepts NTLM, such as Active Directory Certificate Services (AD CS) web enrollment endpoints. This allows the attacker to request a Kerberos Ticket Granting Ticket (TGT) on behalf of the Domain Controller machine account, resulting in complete domain compromise.
3. Infrastructure & Business Impact
This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. A successful compromise of Active Directory infrastructure grants the attacker unrestricted access to all domain-joined assets, user credentials, and sensitive databases, posing an existential threat to business continuity and data confidentiality.
Official Vendor Advisories & References
Windows LSA Spoofing Vulnerability
Frequently Asked SecOps Questions (CVE-2022-26925)
FAQQ1. How critical is CVE-2022-26925 and is it actively exploited in the wild?
CVE-2022-26925 is rated CVSS 5.9 (MEDIUM) with a 30-day EPSS exploitation probability of 10.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-26925?
Primary impacted vendors include microsoft across windows, windows_server. Scope summary: Almost all supported versions of Windows and Windows Server, including Windows Server 2008 through 2022, and Windows 7 through 11
Q3. What temporary mitigations or workarounds exist for CVE-2022-26925 before patching?
[Mitigation] Apply the official Microsoft cumulative security updates immediately, and enforce Extended Protection for Authentication (EPA) along with SMB signing to block NTLM relay paths Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-26925
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows IKE Extension Double Free Remote Code Execution Vulnerability (CVE-2026-33824)
[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems
Windows Remote Access Connection Manager (RasMan) Null Pointer Dereference Local DoS Vulnerability (CVE-2026-21525) Technical Advisory
[Affected Scope] Windows and Windows Server operating systems utilizing the Windows Remote Access Connection Manager (RasMan) service.
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.