CVE-2022-26923 is a domain services privilege escalation vulnerability in Microsoft Active Directory. CISA added it to the Known Exploited Vulnerabilities catalogue on 18 August 2022, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
How CVE-2022-26923 Works in Microsoft Active Directory
CVE-2022-26923 is a privilege escalation flaw in Microsoft active directory domain services. In practical terms, this kind of weakness matters because Domain Services sits close to the trust core of Windows estates, so a successful exploit can turn a foothold into broader domain control.
Privilege escalation issues in directory services are dangerous because they can convert a limited account, a misused service path, or a compromised host into elevated authority over users, groups, computers, and policy enforcement. When those controls are affected, the blast radius can reach authentication, delegation, and downstream administrative workflows.
Why This Vulnerability Class Is High Impact
Directory privilege escalation is especially serious in Active Directory environments because the directory often governs identity, access, and trust for many connected systems at once. A weakness in the domain service layer can therefore become a bridge from one compromised asset to the broader estate, rather than an isolated server issue.
This is also why active exploitation status changes the operational priority. Organisations should treat the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog as the authoritative references for patching and mitigation timing, rather than relying on generic vulnerability lists.
How Organisations Check Exposure and Reduce Attack Paths
Exposure review starts with confirming which domain controllers and related Active Directory components are present, where they are reachable, and whether the vulnerable service is deployed in production, test, or hybrid environments. Asset inventory matters because directory issues are often missed when organisations track Windows hosts but not the role those hosts play in identity infrastructure.
Because exploitation against directory services commonly follows a path from initial access to privilege escalation, defenders should also review internet exposure, remote administration paths, and any trust relationships that could let a low-privilege compromise reach the domain tier. That is the same basic reason the Active Directory and Entra ID Hardening Guide focuses on tier zero, delegation, and privileged groups as part of reducing attack paths.
Where remediation cannot be applied immediately, compensating controls usually mean narrowing who can reach the affected services, tightening administrative separation, and reducing the number of systems that can be used as stepping stones into the domain. In parallel, teams should watch vendor guidance for any temporary mitigations that change the exploitability of the service without removing the underlying flaw.
Detection, Remediation, and Post-Exploitation Review
Once a directory vulnerability is publicly exploited, detection is not limited to the vulnerable host itself. Security teams should review authentication logs, privilege changes, directory replication activity, and unusual administrative operations around the time of exposure, because privilege escalation often leaves evidence in adjacent control planes rather than in a single exploit record.
After patching or mitigation, the incident review should ask whether any privileged accounts, service accounts, certificates, or sessions were touched during compromise. If the vulnerability was used successfully, the identity impact can outlast the code fix, which is why a clean patch without compromise review can leave hidden persistence behind.
For that reason, Vulnerability Management Guide is relevant here as a practical reminder that exploitation status, asset scope, verification, and remediation validation all matter, not just whether a patch exists.
Teams that manage privileged pathways should also compare the findings with Privileged Access Management Guide to decide whether standing privilege, break-glass use, or excessive admin access increased the impact of the exploit.
Risk and Threat Considerations
Directory service privilege escalation can be a gateway to domain-wide compromise, especially when attackers already have a foothold on an internal system. Once elevated, they may use the directory to expand access, tamper with trust relationships, or stage further movement across the enterprise.
Failure mechanism: A flaw in the domain service allows an attacker to cross from ordinary access into elevated directory authority, which can then be used to manipulate identities, permissions, or trust boundaries.
Impact: Successful exploitation can enable broader takeover of Windows identity infrastructure, increase the chance of lateral movement, and create a persistence problem that survives the initial exploit point.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | CVE remediation and verification are central to fixing an exploited Active Directory flaw |
| AC-6 — Least Privilege | Privilege escalation risk is reduced by limiting what compromised accounts can do | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on analysing logs for privilege abuse and follow-on activity | |
| Recommendation — Prioritise flaw remediation for the affected domain controllers and verify fixes are fully deployed. Restrict administrative privileges so a foothold cannot easily become domain-wide authority. Review authentication and directory logs for privilege changes and suspicious administrative actions. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation status makes vulnerability prioritisation and validation critical |
| CIS-5 — Account Management | Directory privilege escalation often turns on excessive or abused account privilege | |
| Recommendation — Use continuous vulnerability management to identify, prioritise, and verify remediation of exploited systems. Limit and review privileged accounts so compromise cannot rapidly expand access. | ||
Practitioner Guidance
Why practitioners should care: Treat exploited directory-service CVEs as identity-infrastructure incidents, not just patching tasks. If attackers can escalate privileges in Active Directory, the remediation scope may include privileged account review, trust-path review, and compromise validation across connected systems.
What to watch for: Pay special attention to unexpected privilege changes, new administrative relationships, unusual directory writes, and signs that domain-level trust was used after the initial intrusion. In a domain environment, those are often the earliest indicators that the issue was exploited beyond the vulnerable host.
Related resources from NHI Mgmt Group
- Why does a dNSHostName change create such a high privilege escalation risk in Active Directory Certificate Services?
- What are the signs that CVE-2022-26923 exploitation is underway in Active Directory?
- Why do default Active Directory settings make privilege escalation easier for attackers with basic domain access?
- What should security teams do first when Active Directory privilege escalation flaws could let attackers take over a Windows domain?