Active Directory Certificate Services (AD CS) has quietly become one of the most consequential attack surfaces in enterprise Windows environments. For years, certificate infrastructure sat in the background, trusted by default and rarely scrutinized. That changed in 2021 and 2022, when security researchers exposed a series of misconfigurations and logic flaws collectively known as the ESC (Escalation) vulnerabilities. Among them, CVE-2022-26923 stands out because it does not rely on an obscure misconfiguration, it exploits a mismatch between how Active Directory validates identity and how certificate templates map that identity to accounts.
This article breaks down what CVE-2022-26923 actually is, why it matters, and how organizations can detect and remediate it.
What CVE-2022-26923 Actually Exploits
CVE-2022-26923 is a privilege escalation vulnerability affecting Active Directory Certificate Services, patched by Microsoft in May 2022. At its core, the flaw takes advantage of the way Windows maps certificates to user or computer accounts using attributes like the Subject Alternative Name (SAN) or the dNSHostName attribute on computer objects.
The underlying issue is straightforward once explained. In many AD environments, a low-privileged user can modify the dNSHostName attribute of a computer object they control, for instance, a machine account they joined to the domain themselves, since by default any authenticated user can join up to ten machines to a domain (a setting called ms-DS-MachineAccountQuota). By changing this attribute to match the hostname of a more privileged machine, such as a domain controller, an attacker can then request a certificate that gets incorrectly bound to the impersonated identity.
Because certificates are trusted implicitly for authentication under many default AD CS configurations, this mismatch allows an attacker to authenticate to Kerberos or Schannel as a machine they should never have had rights to represent.
Why This Vulnerability Gained So Much Attention
CVE-2022-26923 emerged amid growing research into the abuse of Active Directory Certificate Services. Earlier work, including SpecterOps’ “Certified Pre-Owned” research, documented several escalation paths involving certificate-template and AD CS misconfigurations. Unlike many of those attack paths, however, CVE-2022-26923 could be exploited under default Active Directory and AD CS configurations, making the potential exposure considerably broader.
Several factors explain why the vulnerability attracted such intense scrutiny:
- It required only a low-privileged authenticated domain account.
- It took advantage of permissions and settings enabled by default in many environments.
- It provided a path to impersonating computer accounts, including domain controllers, potentially leading to full domain compromise.
- The certificate request could initially resemble legitimate enrollment activity, making the attack difficult to identify without appropriate monitoring.
For organizations operating AD CS, the vulnerability provided a clear reason to examine computer-account creation rights, certificate templates, DNS hostname permissions, and certificate-based authentication controls. It also demonstrated how individually legitimate Active Directory capabilities can become dangerous when combined into an unintended privilege-escalation path.
How the Attack Chain Works in Practice
Understanding the mechanics of CVE-2022-26923 helps explain why patching alone does not fully close the door on AD CS risk. The general attack sequence looks like this:
- An attacker with standard domain credentials creates a new computer account, taking advantage of the default machine account quota.
- The attacker modifies the dNSHostName attribute of that new computer object to match the name of a target system, such as a domain controller.
- The attacker requests a certificate from the AD CS certificate authority using a template that permits client authentication, specifying the spoofed identity.
- Because the certificate template does not properly validate the relationship between the requesting account and the claimed identity, the CA issues a certificate bound to the impersonated hostname.
- The attacker uses this certificate to authenticate via Schannel or Kerberos PKINIT, effectively assuming the privileges of the impersonated machine account.
From there, an attacker who has impersonated a domain controller account can potentially extract sensitive data or pivot toward full domain compromise, depending on the surrounding environment and additional protections in place.
It is worth noting that CVE-2022-26923 is often discussed in the same breath as ESC6 and ESC9/ESC10, since patching one aspect of AD CS certificate mapping does not necessarily eliminate related mapping issues elsewhere in the certificate lifecycle. Microsoft’s fix for CVE-2022-26923 addressed the specific attribute mapping flaw, but organizations still need to review certificate template permissions, enforce strong certificate mapping, and monitor for anomalous certificate requests.
Detection and Mitigation Strategies
Patching is the first and most obvious step — Microsoft’s May 2022 security update addresses the core logic flaw behind CVE-2022-26923. However, patching alone does not address the broader AD CS hardening that security researchers recommend. Effective mitigation typically includes:
- Auditing certificate templates for overly permissive enrollment rights, particularly templates that allow client authentication with attacker-controllable subject names.
- Restricting the machine account quota where it is not operationally necessary, reducing the pool of attacker-controlled computer objects.
- Enabling strong certificate mapping enforcement, which Microsoft has progressively required through related updates following the initial disclosure.
- Monitoring Certificate Authority logs for unusual enrollment patterns, especially requests involving SAN values that don’t match the requesting principal.
- Reviewing delegation and write permissions on computer objects, since the ability to modify dNSHostName is itself a control point worth restricting.
Tools built specifically for AD CS auditing, developed in the wake of the “Certified Pre-Owned” research, can help identify vulnerable templates and misconfigurations at scale, though manual review of certificate authority settings remains valuable for smaller environments.
What We’ve Learned
CVE-2022-26923 illustrates a broader pattern in enterprise security: trust relationships that were designed for convenience — like automatic machine account creation or implicit certificate-to-identity mapping — can become liabilities when their assumptions are stress-tested by a motivated attacker. The vulnerability did not require exotic tools or zero-day exploitation techniques; it relied on default configurations that many administrators had never questioned.
The broader lesson extends beyond this single CVE. AD CS deployments deserve the same scrutiny applied to domain controllers and privileged group memberships, because certificate authorities are, functionally, another form of identity infrastructure. Organizations that treat PKI configuration review as an ongoing practice, rather than a one-time patching exercise, are better positioned to catch the next certificate-based escalation path before it becomes a headline.
Ezarynna Flintfield writes the kind of tech news and innovations content that people actually send to each other. Not because it's flashy or controversial, but because it's the sort of thing where you read it and immediately think of three people who need to see it. Ezarynna has a talent for identifying the questions that a lot of people have but haven't quite figured out how to articulate yet — and then answering them properly.
They covers a lot of ground: Tech News and Innovations, Emerging Technology Trends, Practical Software Tips, and plenty of adjacent territory that doesn't always get treated with the same seriousness. The consistency across all of it is a certain kind of respect for the reader. Ezarynna doesn't assume people are stupid, and they doesn't assume they know everything either. They writes for someone who is genuinely trying to figure something out — because that's usually who's actually reading. That assumption shapes everything from how they structures an explanation to how much background they includes before getting to the point.
Beyond the practical stuff, there's something in Ezarynna's writing that reflects a real investment in the subject — not performed enthusiasm, but the kind of sustained interest that produces insight over time. They has been paying attention to tech news and innovations long enough that they notices things a more casual observer would miss. That depth shows up in the work in ways that are hard to fake.
