Actively exploited in the wild
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft - Active Directory · Listed in the CISA KEV since 2022-08-18. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-26923
HighCVSS 8.8KEVSummary
A privilege elevation vulnerability in Active Directory Domain Services (AD DS). An attacker can gain domain administrator privileges.
Risk Assessment
It allows full takeover of the Active Directory domain, posing a critical threat to the entire infrastructure.
Recommendation
Immediately deploy the May 2022 updates and consider enabling StrongCertificateBindingEnforcement.
Other vulnerabilities in Active Directory Domain Services
See all- CVE-2021-42287HighActively exploited
Active Directory Domain Services Elevation of Privilege Vulnerability. Technical details are not provided in the description.
- CVE-2021-42278HighActively exploited
Active Directory Domain Services Elevation of Privilege Vulnerability. Technical details are not provided in the description.
- CVE-2026-88165High
Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network.
- CVE-2026-83667Medium
Out-of-bounds read vulnerability in Active Directory Domain Services allows an authorized attacker to deny service over a network.
- CVE-2026-83648Medium
Null pointer dereference vulnerability in Active Directory Domain Services allows an authorized attacker to deny service over a network.
- CVE-2026-83647High
Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.
- CVE-2026-70229High
Incorrect authorization in Active Directory Domain Services. An unauthorized attacker can execute code over a network.
- CVE-2026-69809High
Missing release of memory after effective lifetime in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.
- CVE-2026-69546High
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
- CVE-2026-69524High
Use-after-free vulnerability in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
Original NVD description (English source)
Active Directory Domain Services Elevation of Privilege Vulnerability
Vulnerability data from NVD (NIST) · CISA KEV · EPSS