{"id":"CVE-2022-26923","aliases":["CLSA-2026-1777321102","EUVD-2022-31469","GHSA-j9xf-76vv-4wcg"],"status":"published","title":"Active Directory Domain Services Elevation of Privilege Vulnerability","description":"Active Directory Domain Services Elevation of Privilege Vulnerability","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.835,"percentile":0.99689,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-295"],"published":"2022-05-10T20:33:39Z","modified":"2026-06-17T04:36:07Z","kev":{"date_added":"2022-08-18","due_date":"2022-09-08","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-08-18"},{"source":"kev","since":"2022-08-18"}],"exploits":[{"source":"pocgithub","id":"r1skkam/TryHackMe-CVE-2022-26923","title":"r1skkam/TryHackMe-CVE-2022-26923","date":"2022-05-12","url":"https://github.com/r1skkam/TryHackMe-CVE-2022-26923"},{"source":"pocgithub","id":"LudovicPatho/CVE-2022-26923_AD-Certificate-Services","title":"LudovicPatho/CVE-2022-26923_AD-Certificate-Services","date":"2022-05-14","url":"https://github.com/LudovicPatho/CVE-2022-26923_AD-Certificate-Services"},{"source":"pocgithub","id":"lsecqt/CVE-2022-26923-Powershell-POC","title":"lsecqt/CVE-2022-26923-Powershell-POC","date":"2022-08-17","url":"https://github.com/lsecqt/CVE-2022-26923-Powershell-POC"},{"source":"pocgithub","id":"evilashz/PIGADVulnScanner","title":"evilashz/PIGADVulnScanner","date":"2023-10-17","url":"https://github.com/evilashz/PIGADVulnScanner"},{"source":"pocgithub","id":"Gh-Badr/CVE-2022-26923","title":"Gh-Badr/CVE-2022-26923","date":"2023-11-28","url":"https://github.com/Gh-Badr/CVE-2022-26923"},{"source":"pocgithub","id":"Yowise/CVE-2022-26923","title":"Yowise/CVE-2022-26923","date":"2024-09-01","url":"https://github.com/Yowise/CVE-2022-26923"},{"source":"pocgithub","id":"rayngnpc/CVE-2022-26923-rayng","title":"rayngnpc/CVE-2022-26923-rayng","date":"2025-03-04","url":"https://github.com/rayngnpc/CVE-2022-26923-rayng"},{"source":"pocgithub","id":"Eliasdekiniweek/CVE-2022-26923","title":"Eliasdekiniweek/CVE-2022-26923","date":"2026-02-21","url":"https://github.com/Eliasdekiniweek/CVE-2022-26923"},{"source":"pocgithub","id":"Nefhara/CVE-2022-26923","title":"Nefhara/CVE-2022-26923","date":"2026-05-29","url":"https://github.com/Nefhara/CVE-2022-26923"},{"source":"metasploit","id":"auxiliary/admin/dcerpc/cve_2022_26923_certifried","title":"Active Directory Certificate Services (ADCS) privilege escalation (Certifried)","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried"}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ctdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnss-winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libpam-winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libsmbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libsmbclient-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libwbclient-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libwbclient0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"python3-samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"registry-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"samba-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"samba-common-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"samba-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"samba-dsdb-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"samba-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"samba-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"samba-vfs-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"smbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els2"}]}],"bundled":2}],"products":[{"vendor":"microsoft","product":"active directory"},{"vendor":"microsoft","product":"windows 10 version 1507"},{"vendor":"microsoft","product":"windows 10 version 1607"},{"vendor":"microsoft","product":"windows 10 version 1809"},{"vendor":"microsoft","product":"windows 10 version 1909"},{"vendor":"microsoft","product":"windows 10 version 20h2"},{"vendor":"microsoft","product":"windows 10 version 21h1"},{"vendor":"microsoft","product":"windows 10 version 21h2"},{"vendor":"microsoft","product":"windows 11 version 21h2"},{"vendor":"microsoft","product":"windows 8.1"},{"vendor":"microsoft","product":"windows server 2012 r2"},{"vendor":"microsoft","product":"windows server 2012 r2 (server core installation)"},{"vendor":"microsoft","product":"windows server 2016"},{"vendor":"microsoft","product":"windows server 2016 (server core installation)"},{"vendor":"microsoft","product":"windows server 2019"},{"vendor":"microsoft","product":"windows server 2019 (server core installation)"},{"vendor":"microsoft","product":"windows server 2022"},{"vendor":"microsoft","product":"windows server version 20h2"},{"vendor":"microsoft","product":"windows_10_1507"},{"vendor":"microsoft","product":"windows_10_1607"},{"vendor":"microsoft","product":"windows_10_1809"},{"vendor":"microsoft","product":"windows_10_1909"},{"vendor":"microsoft","product":"windows_10_20h2"},{"vendor":"microsoft","product":"windows_10_21h1"},{"vendor":"microsoft","product":"windows_10_21h2"},{"vendor":"microsoft","product":"windows_11_21h2"},{"vendor":"microsoft","product":"windows_8.1"},{"vendor":"microsoft","product":"windows_rt_8.1"},{"vendor":"microsoft","product":"windows_server_2012"},{"vendor":"microsoft","product":"windows_server_2016"},{"vendor":"microsoft","product":"windows_server_2019"},{"vendor":"microsoft","product":"windows_server_2022"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26923","tags":["vendor-advisory","Patch","Vendor Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26923","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26923","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26923"},{"url":"https://github.com/advisories/GHSA-j9xf-76vv-4wcg"},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1777321102.html","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-26923","title":"Active Directory Domain Services Elevation of Privilege Vulnerability","description":"Active Directory Domain Services Elevation of Privilege Vulnerability","status":"published","published":"2022-05-10T20:33:39Z","modified":"2025-10-21T23:15:40.068Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-31469","description":"Active Directory Domain Services Elevation of Privilege Vulnerability","status":"published","published":"2022-05-10T20:33:39Z","modified":"2025-10-21T23:15:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"exploited_since":"2022-08-18","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-j9xf-76vv-4wcg","title":"Active Directory Domain Services Elevation of Privilege Vulnerability.","description":"Active Directory Domain Services Elevation of Privilege Vulnerability.","status":"published","published":"2022-05-11T00:00:58Z","modified":"2025-10-22T00:33:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2022-26923","title":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability","description":"An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.","cwes":["CWE-295"],"kev":{"date_added":"2022-08-18","due_date":"2022-09-08","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-26923","description":"Active Directory Domain Services Elevation of Privilege Vulnerability","status":"published","published":"2022-05-10T21:15:10.133Z","modified":"2026-06-17T04:36:07.943Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:07:19.51203Z"}],"osv":[{"id":"CLSA-2026-1777321102","title":"Fix CVE(s): CVE-2022-26923, CVE-2022-32743","description":"   * SECURITY UPDATE: Samba AD DC did not enforce the Validated-DNS-Host-Name\n     write right, allowing an unprivileged authenticated user with machine\n     account write access (e.g. SeMachineAccountPrivilege) to set the\n     dNSHostName attribute to an arbitrary value, bypassing the MS-ADTS\n     requirement that it match \u003csAMAccountName-sans-$\u003e.\u003cdnsDomainName\u003e.\n     This primitive is commonly chained with CVE-2022-26923 (Certifried) via\n     AD CS to forge a machine certificate and escalate to Domain Admin.\n     - debian/patches/CVE-2022-32743.patch\n     - CVE-2022-32743","status":"published","published":"2026-04-27T20:18:28Z","modified":"2026-06-04T10:04:13.134069Z","updated_at":"2026-11-02T15:43:44.384419Z"}]}}