CVE-2022-26925VulnerabilityPublished 07/01/2022Updated 10/24/2026

CVE-2022-26925: Microsoft Windows LSA Spoofing Vulnerability

Affects Microsoft WindowsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 07/01/2022
KEV deadline: 07/22/2022
EPSS: 10.5% chance of exploitation in 30 days – higher than 95% of CVEs

What to do

CISA required action

Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].

nvd.nist.gov/vuln/detail/CVE-2022-26925 (opens in a new tab)

Description

CVE-2022-26925 is a spoofing vulnerability in the Microsoft Windows Local Security Authority (LSA) that allows an attacker to coerce a domain controller to authenticate to the attacker using NTLM. This vulnerability has been exploited in the wild and is considered high severity.

Summary

Microsoft Windows LSA contains a spoofing vulnerability (CVE-2022-26925) where an attacker can coerce the domain controller to authenticate to the attacker using NTLM authentication. This flaw enables an attacker to impersonate or spoof authentication requests within a Windows domain environment. The vulnerability has been observed in active exploitation scenarios.

Impact

Successful exploitation allows an attacker to coerce a domain controller to authenticate to the attacker, potentially enabling credential theft or lateral movement within a network. This can undermine domain security and facilitate further attacks.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor Microsoft advisories closely and apply any updates promptly once available.

Weaknesses

CWE-306Missing Authentication for Critical Function (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 12:05:26 UTC

Weaknesses

References

Related threats