Security News > 2022 > July > CISA orders agencies to patch Windows LSA bug exploited in the wild
CISA has re-added a security bug affecting Windows devices to its list of bugs exploited in the wild after removing it in May due to Active Directory certificate authentication issues caused by Microsoft's May 2022 updates.
The flaw is an actively exploited Windows LSA spoofing vulnerability tracked as CVE-2022-26925 and confirmed to be a new PetitPotam Windows NTLM Relay attack vector.
Unauthenticated attackers can exploit this bug to force domain controllers to authenticate them remotely via the Windows NT LAN Manager security protocol and, likely, take over the entire Windows domain.
As CISA had already warned when it removed CVE-2022-26925 from its Known Exploited Vulnerability Catalog, the May 2022 Patch Tuesday security updates patched this bug also triggered service authentication problems when deployed on Windows Server domain controllers.
FCEB agencies must comply with CISA's request according to the binding operational directive issued in November to reduce the risk of known exploited bugs across US federal networks.
"Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice," CISA said.
News URL
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-05-10 | CVE-2022-26925 | Missing Authentication for Critical Function vulnerability in Microsoft products Windows LSA Spoofing Vulnerability | 5.9 |