
CVE-2022-26923 Certifried: AD CS Privilege Escalation
CVE-2022-26923 (Certifried) is a privilege escalation vulnerability in Active Directory Certificate Services (AD CS) patched in May 2022. A domain user with the ability to create or modify machine accounts can request a certificate that impersonates a Domain Controller, then use that certificate in a Kerberos PKINIT authentication to obtain a TGT with domain admin-equivalent privileges. CVSS 8.8.
