CVE-2022-26925

Windows LSA Spoofing Vulnerability

CVSS 8.1 HIGHEPSS 9.8%● KEVCWE-306

Vexday Risk Score

51Attention

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

CVSS 8.1EPSS 9.8%KEV simPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

10 May 2022Published on NVD

01 Jul 2022Active exploitation (CISA KEV)

Recommendation: Patch as soon as possible — active exploitation confirmed.

In short

A spoofing vulnerability in Windows Local Security Authority (LSA) allows an attacker to impersonate legitimate security credentials or processes. This could enable unauthorized access to sensitive data or system resources by tricking the system into trusting false security claims.

Technical detail

The vulnerability in Windows LSA (CWE-306: Missing Authentication) permits an attacker to forge or spoof authentication credentials without proper verification. An authenticated or local attacker can manipulate LSA validation mechanisms to impersonate privileged users or processes, potentially gaining elevated access or bypassing security policy enforcement.

Summary generated and translated by AI from the official description.

Windows LSA Spoofing Vulnerability

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected products

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26925 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26925 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26925