All vulnerabilities
CVE-2022-26925

Microsoft Windows LSA Spoofing Vulnerability

Microsoft WindowsOperating systems
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationExploited in the wildAdded to KEV 1 Jul 2022CISA KEV
Exploit odds (EPSS)10.5%Chance of exploitation activity in the next 30 days, higher than 95% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.17763.2928Also 10.0.18363.2274, 10.0.19043.1706 and 9 moreCVE List
Federal deadline22 Jul 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch]. CISA KEV

What fixes it

  • 10.0.17763.2928Windows 10 Version 1809CVE List
  • 10.0.17763.2928Windows Server 2019CVE List
  • 10.0.17763.2928Windows Server 2019 (Server Core installation)CVE List
  • 10.0.18363.2274Windows 10 Version 1909CVE List
  • 10.0.19043.1706Windows 10 Version 21H1CVE List
  • 10.0.20348.707Windows Server 2022CVE List
Show all 26 fixed versions
  • 10.0.19042.1706Windows 10 Version 20H2CVE List
  • 10.0.19042.1706Windows Server version 20H2CVE List
  • 10.0.22000.675Windows 11 version 21H2CVE List
  • 10.0.19043.1706Windows 10 Version 21H2CVE List
  • 10.0.10240.19297Windows 10 Version 1507CVE List
  • 10.0.14393.5125Windows 10 Version 1607CVE List
  • 10.0.14393.5125Windows Server 2016CVE List
  • 10.0.14393.5125Windows Server 2016 (Server Core installation)CVE List
  • 6.1.7601.25954Windows 7CVE List
  • 6.1.7601.25954Windows 7 Service Pack 1CVE List
  • 6.3.9600.20371Windows 8.1CVE List
  • 6.0.6003.21481Windows Server 2008 Service Pack 2CVE List
  • 6.0.6003.21481Windows Server 2008 Service Pack 2 (Server Core installation)CVE List
  • 6.0.6003.21481Windows Server 2008 Service Pack 2CVE List
  • 6.1.7601.25954Windows Server 2008 R2 Service Pack 1CVE List
  • 6.1.7601.25954Windows Server 2008 R2 Service Pack 1 (Server Core installation)CVE List
  • 6.2.9200.23714Windows Server 2012CVE List
  • 6.2.9200.23714Windows Server 2012 (Server Core installation)CVE List
  • 6.3.9600.20371Windows Server 2012 R2CVE List
  • 6.3.9600.20371Windows Server 2012 R2 (Server Core installation)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 10 May 2022, 20:33 UTCPublishedCVE List
  2. 1 Jul 2022Added to CISA KEVCISA KEV

Description

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.

Text from CVE List

Affected versions 27

  • Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.2928CVE List
  • Windows 10 Version 1809affected: 10.0.0 before 10.0.17763.2928CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.2928CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.2928CVE List
  • Windows 10 Version 1909affected: 10.0.0 before 10.0.18363.2274CVE List
  • Windows 10 Version 21H1affected: 10.0.0 before 10.0.19043.1706CVE List
  • Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.707CVE List
  • Windows 10 Version 20H2affected: 10.0.0 before 10.0.19042.1706CVE List
  • Windows Server version 20H2affected: 10.0.0 before 10.0.19042.1706CVE List
  • Windows 11 version 21H2affected: 10.0.0 before 10.0.22000.675CVE List
  • Windows 10 Version 21H2affected: 10.0.19043.0 before 10.0.19043.1706CVE List
  • Windows 10 Version 1507affected: 10.0.10240.0 before 10.0.10240.19297CVE List
  • Windows 10 Version 1607affected: 10.0.14393.0 before 10.0.14393.5125CVE List
  • Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.5125CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.5125CVE List
  • Windows 7affected: 6.1.0 before 6.1.7601.25954CVE List
  • Windows 7 Service Pack 1affected: 6.1.0 before 6.1.7601.25954CVE List
  • Windows 8.1affected: 6.3.0 before 6.3.9600.20371CVE List
  • Windows Server 2008 Service Pack 2affected: 6.0.6003.0 before 6.0.6003.21481CVE List
  • Windows Server 2008 Service Pack 2 (Server Core installation)affected: 6.0.6003.0 before 6.0.6003.21481CVE List
  • Windows Server 2008 Service Pack 2affected: 6.0.6003.0 before 6.0.6003.21481CVE List
  • Windows Server 2008 R2 Service Pack 1affected: 6.1.7601.0 before 6.1.7601.25954CVE List
  • Windows Server 2008 R2 Service Pack 1 (Server Core installation)affected: 6.1.7601.0 before 6.1.7601.25954CVE List
  • Windows Server 2012affected: 6.2.9200.0 before 6.2.9200.23714CVE List
  • Windows Server 2012 (Server Core installation)affected: 6.2.9200.0 before 6.2.9200.23714CVE List
  • Windows Server 2012 R2affected: 6.3.9600.0 before 6.3.9600.20371CVE List
  • Windows Server 2012 R2 (Server Core installation)affected: 6.3.9600.0 before 6.3.9600.20371CVE List

References 4