Security News > 2022 > May > Microsoft fixes new NTLM relay zero-day in all Windows versions
Microsoft has addressed an actively exploited Windows LSA spoofing zero-day that unauthenticated attackers can exploit remotely to force domain controllers to authenticate them via the Windows NT LAN Manager security protocol.
The vulnerability, tracked as CVE-2022-26925 and reported by Bertelsmann Printing Group's Raphael John, has been exploited in the wild and seems to be a new vector for the PetitPotam NTLM relay attack.
LockFile ransomware operators have abused the PetitPotam NTLM relay attack method to hijack Windows domains and deploy malicious payloads.
Microsoft advises Windows admins to check PetitPotam mitigations and mitigation measures against NTLM Relay Attacks on Active Directory Certificate Services for more info on protecting their systems from CVE-2022-26925 attacks.
Installing these updates also comes with downsides on systems running Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1, as they will break backup software from some vendors.
CVE-2022-26925 impacts all Windows versions, including client and server platforms, starting from Windows 7 and Windows Server 2008 to Windows 11 and Windows 2022.
News URL
Related news
- Microsoft patches Windows Kernel zero-day exploited since 2023 (source)
- New Windows zero-day leaks NTLM hashes, gets unofficial patch (source)
- Microsoft Will Remove the Free VPN That Comes With Windows Defender Soon (source)
- New Microsoft script updates Windows media with bootkit malware fixes (source)
- Microsoft has finally fixed Date & Time bug in Windows 11 (source)
- Microsoft shares workaround for Windows security update issues (source)
- Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws (source)
- Windows 10 KB5051974 update force installs new Microsoft Outlook app (source)
- Microsoft fixes two actively exploited zero-days (CVE-2025-21418, CVE-2025-21391) (source)
- Patch Tuesday: Microsoft Patches Two Actively Exploited Zero-Day Flaws (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-05-10 | CVE-2022-26925 | Missing Authentication for Critical Function vulnerability in Microsoft products Windows LSA Spoofing Vulnerability | 5.9 |