Security News > 2022 > May > Microsoft fixes new NTLM relay zero-day in all Windows versions
Microsoft has addressed an actively exploited Windows LSA spoofing zero-day that unauthenticated attackers can exploit remotely to force domain controllers to authenticate them via the Windows NT LAN Manager security protocol.
The vulnerability, tracked as CVE-2022-26925 and reported by Bertelsmann Printing Group's Raphael John, has been exploited in the wild and seems to be a new vector for the PetitPotam NTLM relay attack.
LockFile ransomware operators have abused the PetitPotam NTLM relay attack method to hijack Windows domains and deploy malicious payloads.
Microsoft advises Windows admins to check PetitPotam mitigations and mitigation measures against NTLM Relay Attacks on Active Directory Certificate Services for more info on protecting their systems from CVE-2022-26925 attacks.
Installing these updates also comes with downsides on systems running Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1, as they will break backup software from some vendors.
CVE-2022-26925 impacts all Windows versions, including client and server platforms, starting from Windows 7 and Windows Server 2008 to Windows 11 and Windows 2022.
News URL
Related news
- Microsoft patches Windows zero-day exploited in attacks on Ukraine (source)
- New Windows zero-day exposes NTLM credentials, gets unofficial patch (source)
- Microsoft blames Windows Server 2025 automatic upgrades on 3rd-party tools (source)
- Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 91 flaws (source)
- Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws (source)
- Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039) (source)
- Microsoft fixes bugs causing Windows Server 2025 blue screens, install issues (source)
- Microsoft Fixes 90 New Flaws, Including Actively Exploited NTLM and Task Scheduler Bugs (source)
- How a Windows zero-day was exploited in the wild for months (CVE-2024-43451) (source)
- Microsoft just killed the Windows 10 Beta Channel again (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-05-10 | CVE-2022-26925 | Missing Authentication for Critical Function vulnerability in Microsoft products Windows LSA Spoofing Vulnerability | 5.9 |