CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Active Directory Domain Services Privilege Escalation Vulnerability (CVE-2022-26923) Analysis and Mitigation Guide
[Affected Scope] All Windows Server Domain Controllers in environments where Active Directory Certificate Services (ADCS) is enabled.
[Impact] A low-privileged domain user can obtain a certificate for the Domain Controller's computer account, leading to full Domain Admin privilege escalation.
[Mitigation] Apply the official Microsoft cumulative security updates and harden the dNSHostName mapping validation on ADCS.
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability (CVE-2021-42287) Technical Advisory
[Affected Scope] Windows Server systems configured as Active Directory Domain Controllers (DCs).
[Impact] A standard domain user can exploit Kerberos name resolution flaws to impersonate a Domain Controller computer account, escalating privileges to Domain Admin and compromising the entire AD forest.
[Mitigation] Apply the latest Microsoft cumulative security updates to all Domain Controllers and enforce Kerberos validation hardening via registry configurations.
Active Directory Domain Services Privilege Escalation Vulnerability (CVE-2021-42278) Analysis and Mitigation Guide
[Affected Scope] All Windows Server Domain Controllers (from 2008 to 2022) running Active Directory Domain Services (AD DS)
[Impact] A standard domain user can spoof a Domain Controller's computer account name, escalate privileges to Domain Admin, and achieve full domain compromise
[Mitigation] Apply the latest Microsoft cumulative security updates and ensure the KB5008380 registry settings are transitioned to Enforcement mode
Microsoft Windows Kerberos KDC Signature Verification Bypass and Domain Privilege Escalation (CVE-2014-6324)
[Affected Scope] Active Directory Domain Controllers running Windows Server 2003, 2008, 2012, and associated Windows client operating systems
[Impact] A remote authenticated domain user can forge Kerberos ticket signatures (PAC) to escalate privileges to Domain Administrator, leading to a complete domain compromise
[Mitigation] Immediately apply the MS14-068 security update and perform a double reset of the krbtgt account password to invalidate existing forged tickets