CVE-2022-26923
Improper Certificate Validation — is CVE-2022-26923real, exploitable, or a false positive? Here's the community ground truth.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Active Directory Domain Services Elevation of Privilege Vulnerability
NVD only has a brief summary for this one — the community fills in the real-world detail below.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2022-26923)<a href="https://www.truepositive.app/cve/CVE-2022-26923"><img src="https://www.truepositive.app/cve/CVE-2022-26923/badge.svg" alt="TruePositive verdict for CVE-2022-26923"></a>Live badge — updates automatically as the community verdict changes.
Community ground truth
Community verdict
3 verdictsIncludes TruePositive's curated baseline from public sources — community verdicts accrue on top.
Pick your verdict — we'll save it right after a quick sign-in.
In line with its CVSS base score.
Field notes & remediation
Verdicts are the quick signal — notes are the evidence and fixes behind them.
- 0
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability — An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM. Listed in the CISA KEV catalog (added 2022-08-18) — confirmed exploited in the wild, not theoretical. FIRST EPSS puts the chance of exploitation in the next 30 days at ~83%. Treat it as real and prioritize remediation over triage.
- 0
Required action for Microsoft Active Directory: Apply updates per vendor instructions. CISA set a federal remediation due date of 2022-09-08. After patching, verify the vulnerable path is no longer reachable before closing the finding.
Related CVEs
Same weakness — CWE-295 · Improper Certificate Validation.