CVE-2022-26925

Windows LSA Spoofing Vulnerability

MEDIUM

5.9

CVSS Score

Published: May 10, 2022 at 08:33 PM UTC

Updated: June 17, 2026 at 04:36 AM UTC

17 products affected across 1 vendorWindows Server 2016Windows Server 2019Windows Server 2012

Using Windows 10 Version 1809 by Microsoft?

Get instant alerts when new vulnerabilities affect Windows 10 Version 1809 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.9

Exploitation

CISA KEV

Exploit prediction

EPSS 10%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score10.5%

EPSS (Exploit Prediction Scoring System) estimates a 10.5% chance this CVE is exploited in the wild within the next 30 days — higher than 96% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.

Required Action

Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].

Ransomware Use

Unknown

Added to KEV

Jul 1, 2022

Remediation Due

Jul 22, 2022

1561 days overdue

Notes

WARNING: This update is required on all Microsoft Windows endpoints but if deployed to domain controllers without additional configuration changes the update breaks PIV/CAC authentication. Read CISA implementation guidance carefully before deploying to domain controllers.

https://nvd.nist.gov/vuln/detail/CVE-2022-26925

Description

Windows LSA Spoofing Vulnerability

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Windows 10 1507 · Microsoft

95%

v < 10.0.10240.1929710.0.10240.0 ≤ v < 10.0.10240.1929710.0.10240.0

Affected range stops below 10.0.10240.19297, so it looks safe — our inference, not a vendor statement

Windows 10 1607 · Microsoft

95%

v < 10.0.14393.512510.0.14393.0 ≤ v < 10.0.14393.512510.0.14393.0

Affected range stops below 10.0.14393.5125, so it looks safe — our inference, not a vendor statement

Windows 10 1809 · Microsoft

95%

v < 10.0.17763.292810.0.0 ≤ v < 10.0.17763.292810.0.17763.0 ≤ v < 10.0.17763.292810.0.0 10.0.17763.0

Affected range stops below 10.0.17763.2928, so it looks safe — our inference, not a vendor statement

Windows 10 1909 · Microsoft

95%

v < 10.0.18363.227410.0.0 ≤ v < 10.0.18363.227410.0.0

Affected range stops below 10.0.18363.2274, so it looks safe — our inference, not a vendor statement

Windows 10 20H2 · Microsoft

95%

v < 10.0.19042.170610.0.0 ≤ v < 10.0.19042.170610.0.0

Affected range stops below 10.0.19042.1706, so it looks safe — our inference, not a vendor statement

Windows 10 21H1 · Microsoft

95%

v < 10.0.19043.170610.0.0 ≤ v < 10.0.19043.170610.0.0

Affected range stops below 10.0.19043.1706, so it looks safe — our inference, not a vendor statement

Windows 10 21H2 · Microsoft

95%

v < 10.0.19044.170610.0.19043.0 ≤ v < 10.0.19043.170610.0.19043.0

Affected range stops below 10.0.19043.1706, so it looks safe — our inference, not a vendor statement

Affected range stops below 10.0.19044.1706, so it looks safe — our inference, not a vendor statement

Windows 11 21H2 · Microsoft

95%

v < 10.0.22000.67510.0.0 ≤ v < 10.0.22000.67510.0.0

Affected range stops below 10.0.22000.675, so it looks safe — our inference, not a vendor statement

Windows 7 · Microsoft

95%

6.1.0 ≤ v < 6.1.7601.259546.1.0sp1

Affected range stops below 6.1.7601.25954, so it looks safe — our inference, not a vendor statement

Windows 8-1 · Microsoft

95%

6.3.0 ≤ v < 6.3.9600.203716.3.0

Affected range stops below 6.3.9600.20371, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

Vendor AdvisoryPatch

Source: [email protected]

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26925

PatchVendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26925

US Government Resource

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26925

SSVC — Action Prioritization

SSVCActiveAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.9MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: HIGH
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: HIGH
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-306

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card