Security News > 2022 > May > Microsoft fixes new NTLM relay zero-day in all Windows versions
Microsoft has addressed an actively exploited Windows LSA spoofing zero-day that unauthenticated attackers can exploit remotely to force domain controllers to authenticate them via the Windows NT LAN Manager security protocol.
The vulnerability, tracked as CVE-2022-26925 and reported by Bertelsmann Printing Group's Raphael John, has been exploited in the wild and seems to be a new vector for the PetitPotam NTLM relay attack.
LockFile ransomware operators have abused the PetitPotam NTLM relay attack method to hijack Windows domains and deploy malicious payloads.
Microsoft advises Windows admins to check PetitPotam mitigations and mitigation measures against NTLM Relay Attacks on Active Directory Certificate Services for more info on protecting their systems from CVE-2022-26925 attacks.
Installing these updates also comes with downsides on systems running Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1, as they will break backup software from some vendors.
CVE-2022-26925 impacts all Windows versions, including client and server platforms, starting from Windows 7 and Windows Server 2008 to Windows 11 and Windows 2022.
News URL
Related news
- Microsoft fixes actively exploited Windows Hyper-V zero-day flaws (source)
- Microsoft may have scrapped Windows 11's dynamic wallpapers feature (source)
- Microsoft to force install new Outlook on Windows 10 PCs in February (source)
- Microsoft 365 apps crash on Windows Server after Office update (source)
- Microsoft January 2025 Patch Tuesday fixes 8 zero-days, 159 flaws (source)
- 3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update (source)
- Microsoft ends support for Office apps on Windows 10 in October (source)
- Microsoft expands testing of Windows 11 admin protection feature (source)
- Microsoft starts force upgrading Windows 11 22H2, 23H3 devices (source)
- Microsoft fixes Office 365 apps crashing on Windows Server systems (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-05-10 | CVE-2022-26925 | Missing Authentication for Critical Function vulnerability in Microsoft products Windows LSA Spoofing Vulnerability | 5.9 |