Actively exploited in the wild
Microsoft Windows LSA Spoofing Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2022-07-01. This indicates confirmed attacks in production environments.
Required action: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
CVE-2022-26925
HighCVSS 8.1KEVSummary
A spoofing vulnerability in the Windows LSA service. An attacker can force a domain controller to authenticate to a malicious server.
Risk Assessment
It may lead to taking over a machine account in the domain and further privilege escalation within the Active Directory environment.
Recommendation
Install the June 2022 security updates as soon as possible and enforce LDAP signing and channel binding.
Other vulnerabilities in Windows LSA
See all- CVE-2021-36942HighActively exploited
A spoofing vulnerability in Windows LSA (Local Security Authority).
- CVE-2021-33788High
Denial of service vulnerability in Windows LSA. Could cause service failure.
- CVE-2021-33786High
Security feature bypass vulnerability in Windows LSA (Local Security Authority). An attacker could bypass security mechanisms.
Original NVD description (English source)
Windows LSA Spoofing Vulnerability