Riskcovery

CVE-2022-26923

Active Directory Domain Services Elevation of Privilege Vulnerability

State
Published
Severity
8.8 High
Published
May 10, 2022
Updated
Oct 21, 2025
Reserved
Mar 11, 2022

Read the record on cve.org

Description

Active Directory Domain Services Elevation of Privilege Vulnerability

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Cmicrosoft

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
Windows 10 Version 1809Microsoft
  • 10.0.17763.0 to before 10.0.17763.4252Affected
Windows 10 Version 1809Microsoft
  • 10.0.0 to before 10.0.17763.4252Affected
Windows Server 2019Microsoft
  • 10.0.17763.0 to before 10.0.17763.4252Affected
Windows Server 2019 (Server Core installation)Microsoft
  • 10.0.17763.0 to before 10.0.17763.4252Affected
Windows 10 Version 1909Microsoft
  • 10.0.0 to before 10.0.18363.2274Affected
Windows 10 Version 21H1Microsoft
  • 10.0.0 to before 10.0.19043.1706Affected
Windows Server 2022Microsoft
  • 10.0.20348.0 to before 10.0.20348.1668Affected
Windows 10 Version 20H2Microsoft
  • 10.0.0 to before 10.0.19042.1706Affected
Windows Server version 20H2Microsoft
  • 10.0.0 to before 10.0.19042.1706Affected
Windows 11 version 21H2Microsoft
  • 10.0.0 to before 10.0.22000.1817Affected
Windows 10 Version 21H2Microsoft
  • 10.0.19043.0 to before 10.0.19043.1706Affected
Windows 10 Version 1507Microsoft
  • 10.0.10240.0 to before 10.0.10240.19297Affected
Windows 10 Version 1607Microsoft
  • 10.0.14393.0 to before 10.0.14393.5850Affected
Windows Server 2016Microsoft
  • 10.0.14393.0 to before 10.0.14393.5850Affected
Windows Server 2016 (Server Core installation)Microsoft
  • 10.0.14393.0 to before 10.0.14393.5850Affected
Windows 8.1Microsoft
  • 6.3.0 to before 6.3.9600.20371Affected
Windows Server 2012 R2Microsoft
  • 6.3.9600.0 to before 6.3.9600.20919Affected
Windows Server 2012 R2 (Server Core installation)Microsoft
  • 6.3.9600.0 to before 6.3.9600.20919Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.