Critical Privilege Escalation in Microsoft Active Directory (CVE‑2022‑26923) Enables SYSTEM Access
What It Is — An authenticated attacker can modify attributes on computer accounts they own or manage and request a certificate from Active Directory Certificate Services (AD CS). The issued certificate can be leveraged to elevate privileges to the local SYSTEM account.
Exploitability — Publicly disclosed (CVE‑2022‑26923) with a CVSS v3.1 base score of 9.8 (Critical). Exploits require valid domain credentials; no public exploit code is known, but the attack chain is well‑documented.
Affected Products — Microsoft Windows Server 2012 R2, 2016, 2019, and 2022 running Active Directory Domain Services (AD DS) and Active Directory Certificate Services (AD CS).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of privileged‑access activity and certificate issuance is essential to produce defensible audit evidence.
- The flaw reveals a gap in least‑privilege enforcement; without proper controls an attacker can jump from a low‑privilege account to SYSTEM, breaking the trust model.
- Enterprise buyers now expect demonstrable evidence that identity‑and‑access controls are actively validated and that deviations trigger alerts.
Recommended Actions
- Deploy Microsoft’s security update (KB 5008602) that patches CVE‑2022‑26923.
- Enable detailed auditing for AD CS certificate enrollment and set up alerts for anomalous requests.
- Review and restrict delegation rights on computer objects; enforce least‑privilege principles for account management.
- Integrate this vulnerability into your privileged‑access‑management (PAM) control set and capture remediation evidence for audit readiness.
Source: CISA KEV – CVE‑2022‑26923