Is CVE-2022-26923 (Microsoft Active Directory Domain Services Privilege Escalation) being exploited in the wild?

What “being exploited in the wild” means for this CVE

CISA’s KEV listing is the practical signal that matters here. It means this Microsoft Active Directory domain services privilege escalation flaw is not just theoretical, organisations should assume real attack activity is already underway and treat exposure as urgent rather than speculative.

For defenders, the key question is not whether exploitation is possible, but whether any domain controller, certificate services path, or reachable AD DS instance is still exposed in a way that lets an authenticated user abuse object ownership or delegated management rights. That is the condition that turns a patch item into an incident-prevention priority.

Because the flaw can be chained through Active Directory Certificate Services, the security impact is broader than a single server. A privilege escalation path that reaches SYSTEM can become a foothold for persistence, credential access, and follow-on domain compromise if the environment is already permissive or poorly segmented.

How to confirm exposure and reduce the blast radius

Start by identifying every Windows Server system running AD DS and every deployment that also exposes Active Directory Certificate Services. Confirm whether any authenticated user, delegated admin, or machine account owner can modify the computer-account attributes involved in the abuse path. If you cannot answer that quickly, treat the environment as potentially exposed.

Then verify whether the organisation can patch promptly or whether an exception is being used as a substitute for remediation. For a KEV-listed issue, the correct posture is to validate exposure first, then apply the vendor’s fix or mitigations as soon as operationally possible. If patching must wait, the temporary control should be as narrow and time-bound as possible, with explicit approval and monitoring.

To support that triage, use the CISA Known Exploited Vulnerabilities Catalog and the vendor advisory for exact remediation guidance. For broader exploit-priority triage, the Zero-Day and Exploited Vulnerabilities Guide and the Vulnerability Management Guide give the right operational sequence for KEV-listed exposures.

What to check if compromise may already have happened

When a vulnerability is already being exploited in the wild, remediation alone is not enough if attackers may have used the path before you closed it. Review relevant domain controller, certificate services, and Windows security logs for unusual attribute changes, unexpected certificate enrollment activity, privilege changes, and suspicious authentication patterns from accounts that should not be performing administration.

If you find evidence that the path was used, rotate credentials and invalidate sessions for any accounts, service principals, or management identities that could have been touched during the attack window. In this class of issue, the practical objective is to remove attacker durability, not just close the initial flaw.

Attack-path context matters, so map the environment against the MITRE ATT&CK Enterprise Matrix for credential access, privilege escalation, and persistence techniques that commonly follow domain-level exploitation. If the issue is part of a wider directory-hygiene problem, the Active Directory and Entra ID Hardening Guide is the most useful internal follow-on for reducing the same class of risk elsewhere in the forest or hybrid estate.

Risk and Threat Considerations

The main risk is that a low-friction authenticated abuse path becomes a high-impact directory compromise path. Once an attacker can turn ordinary account rights into SYSTEM-level control through certificate issuance or attribute manipulation, the environment may be exposed to lateral movement, credential theft, and broader administrative takeover.

Failure mechanism: The flaw depends on a privilege boundary that is weaker than it appears, so an authenticated actor can manipulate objects they control and convert that control into certificate-backed escalation.

Impact: Successful exploitation can give the attacker domain-relevant privilege, which materially increases the chance of persistence, trust abuse, and further compromise across Windows identity infrastructure.

Practitioner Guidance

What to prioritise: Treat KEV-listed directory privilege escalation as a remediation-and-hunt event, not a routine patch ticket. Exposure is highest where AD CS is present and delegated ownership or modification rights are broad.

What to verify: Confirm whether any account other than tightly controlled administrators can influence the affected computer-account attributes or obtain certificates through paths that bypass intended privilege boundaries. If yes, assume the blast radius is larger than the single CVE.

Decision rule: If you cannot patch immediately, compensate with temporary restriction, monitoring, and explicit exception ownership, but do not let the exception become the control. The longer the delay, the more important post-exploitation review becomes.

Practitioner takeaway: For a KEV-listed Active Directory flaw, the operational question is not only “is it exploited?” but “could an attacker already have used it to inherit trust inside the directory?”

Related resources from NHI Mgmt Group

• CVE-2022-26923 (Microsoft Active Directory Domain Services Privilege Escalation)
• CVE-2021-42287 (Microsoft Active Directory Domain Services Privilege Escalation)
• CVE-2021-42278 (Microsoft Active Directory Domain Services Privilege Escalation)
• Is CVE-2014-1812 (Microsoft Windows Group Policy Preferences Password Privilege Escalation) being exploited in the wild?