CVE-2022-26925 is a LSA spoofing vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 1 July 2022, which means attackers have used it in real attacks. Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.
What this vulnerability means
LSA spoofing vulnerabilities matter because they let an attacker trick a Windows system into treating a malicious interaction as legitimate authentication. In this case, the core abuse is coercing the domain controller to authenticate to the attacker over NTLM, which turns trust in internal authentication flows into a weapon.
That makes the flaw especially dangerous in domain environments, where a successful spoof can expose authentication material, enable impersonation, and create a foothold for later movement. The CVE Program is the authoritative place to confirm the identifier and its record details, while Microsoft’s advisory and the NIST National Vulnerability Database are the right references for version-specific exposure and remediation guidance.
Why it is dangerous in Windows domain authentication
Windows LSA sits close to the core of trust establishment, so spoofing there can undermine assumptions that authentication requests originate from a legitimate peer. When a domain controller is induced to authenticate outward, the attacker can capture or relay that trust relationship instead of attacking the password directly.
This pattern is dangerous because NTLM-based coercion attacks often sit on the boundary between authentication abuse and privilege escalation. Once trust is abused, the attacker may gain material leverage over identities, sessions, or downstream services that accept the coerced authentication as proof of legitimacy.
How organisations assess exposure and contain it
Exposure assessment starts with asset inventory and domain-role mapping: identify which systems are domain controllers, which still rely on NTLM paths, and which internet-facing or lateral paths could make coercion easier. A vulnerability like this is not just about one host, it is about whether the authentication path can be reached and abused in your environment.
Containment is strongest when organisations reduce unnecessary NTLM reliance, segment high-value authentication infrastructure, and tighten who can initiate authentication-relevant traffic toward domain controllers. The NIST Cybersecurity Framework 2.0 is useful here for organising identify, protect, detect and respond activities, while NIST SP 800-207 Zero Trust Architecture supports the broader shift away from implicit trust in internal authentication flows.
Remediation, detection, and post-incident review
For remediation, follow the vendor advisory and apply the CISA KEV prioritisation lens rather than treating this as a routine patch queue item. If patching cannot happen immediately, compensating controls should focus on reducing exposure to coercion paths, restricting NTLM where feasible, and watching for abnormal authentication from systems that should not be initiating it.
Detection should include logs for unusual machine-to-machine authentication, suspicious NTLM activity, and signs that a domain controller has authenticated to an unexpected endpoint. After patching, review whether credentials, sessions, or privileged trust relationships were exposed during exploitation, and rotate or invalidate any material that may have been captured or relayed during the attack.
Risk and Threat Considerations
LSA spoofing is risky because it can convert an authentication trust path into a credential or relay opportunity. In a domain environment, that can expose high-value authentication material and support lateral movement even if the original exploit did not begin with stolen credentials.
Failure mechanism: The attacker abuses the system’s trust in NTLM-based authentication flows to coerce a domain controller into authenticating back to an attacker-controlled endpoint.
Impact: Successful abuse can enable credential relay, impersonation, privilege escalation, or further movement inside the domain, especially where monitoring does not flag unexpected authentication direction.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1187 — Forced Authentication | LSA spoofing coerces a system to authenticate to an attacker-controlled target. |
| Recommendation — Hunt for forced-authentication activity and alert on unexpected outbound authentication from domain controllers. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Domain authentication trust is the core asset the vulnerability abuses. |
| IA-9 — Identification and Authentication (Non-Organizational Users) | The attack abuses machine-to-machine authentication behavior across trust boundaries. | |
| AC-6 — Least Privilege | Limiting who can trigger or relay authentication reduces attack impact. | |
| Recommendation — Strengthen organizational authentication paths and restrict where privileged authentication can originate. Apply strong authentication controls to service and system connections that cross trust boundaries. Reduce authentication and relay opportunities by enforcing least privilege on sensitive systems. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The attack exploits weakly trusted authentication behavior rather than direct password theft. |
| Recommendation — Treat spoofable authentication paths as insecure and remove unnecessary trust relationships. | ||