CVE-2022-26923

How CVE-2022-26923 Works

CVE-2022-26923 affects Microsoft Windows Active Directory Certificate Services, where weak certificate mapping and trust handling can let an attacker present a forged enrollment path that is accepted as domain-controller-level identity.

The danger is not the certificate itself, but the trust decision behind it. When certificate-to-account binding is too permissive, an attacker can shift from a low-privilege foothold to a credentialed position that the directory treats as authoritative.

For background on the vulnerability record and authoritative naming, use the CVE Program and the NIST National Vulnerability Database.

Why This Vulnerability Can Become a Domain Compromise

This issue matters because Active Directory Certificate Services sits inside the trust fabric of Windows identity. If an attacker can impersonate a domain controller, they can often validate themselves into operations that normal users cannot perform, including actions associated with domain administration.

That makes the flaw especially dangerous in environments where certificates are used for authentication, enrollment, or privileged trust relationships. A single bad mapping decision can collapse a boundary that defenders assume is still separating ordinary identities from directory-level authority.

Organisations should treat this as a trust-boundary failure in directory infrastructure, not just a patchable application bug. In practice, the blast radius can include authentication, policy enforcement, and downstream privilege assignment across the domain.

How Organisations Check Exposure and Reduce Risk

Exposure review starts with inventorying where Active Directory Certificate Services is deployed, which certificate templates and enrollment paths are enabled, and whether domain controllers or administrative workflows depend on certificate-based trust. Internal exposure should be assessed together with any internet-reachable management surfaces and vendor guidance for the exact deployment.

When remediation cannot be applied immediately, reduce the attack surface by limiting who can enroll certificates, constraining administrative access to AD CS, and tightening certificate issuance and mapping paths that can be abused to impersonate privileged systems.

The most useful operational reference is the Vulnerability Management Guide, which covers asset scoping, prioritisation, remediation verification, and exception handling for vulnerabilities that threaten core identity infrastructure.

Detection, Verification, and Identity Impact After Exploitation

Detection should focus on signs that certificates, enrollment behavior, or authentication paths were used in ways that do not match normal administrative patterns. Because the flaw can be used to obtain domain administrator-level access, post-incident review should assume that credentials, sessions, and privileged trust relationships may have been exposed.

After containment, teams should verify whether the compromise reached domain-controller trust or touched any privileged certificate enrollment paths. If exploitation is confirmed or strongly suspected, review and rotate the identity material that could preserve access, including administrator credentials, privileged sessions, and any keys or certificates that were part of the trust chain.

For a broader pattern view of how adversaries turn leaked credentials and trusted access paths into full compromise, the State of NHI & AI Agent Breach Report 2026 shows why identity-centric compromise often becomes a lateral-movement problem rather than a single-host event.

Risk and Threat Considerations

This vulnerability is high risk because it targets trust, not just availability or input validation. If an attacker can forge a certificate path that the directory accepts, they can move from initial access to domain-level authority without needing to steal a domain administrator password first.

Failure mechanism: Weak certificate mapping allows a forged or improperly trusted certificate to be accepted as proof of a more privileged directory identity, collapsing the separation between ordinary enrollment and authoritative authentication.

Impact: The attacker can impersonate a domain controller, gain domain administrator privileges, and use that position for persistence, broad privilege abuse, and follow-on compromise of the Windows identity environment.

Practitioner Guidance

Why practitioners should care: Treat AD CS as core identity infrastructure, not a peripheral service. If certificate trust is misconfigured, a vulnerability like this can convert an authentication weakness into full directory compromise.

What to watch for: Investigate unexpected certificate issuance, unusual mapping behavior, and authentication events that do not align with the normal role of the requesting host or account. Those signals matter most when they appear near privileged directory operations.

Practitioner takeaway: The key defensive question is whether your certificate trust model can still distinguish legitimate domain infrastructure from a forged identity claim.

Related resources from NHI Mgmt Group

• What are the signs that CVE-2022-26923 exploitation is underway in Active Directory?
• What happens when a forged certificate is used against a patched domain controller after CVE-2022-26923 remediation?
• Is CVE-2022-26923 (Microsoft Active Directory Domain Services Privilege Escalation) being exploited in the wild?
• How do you patch or mitigate CVE-2022-26923 (Microsoft Active Directory Domain Services Privilege Escalation)?