Actively exploited · Published May 10, 2022 · Assigned by microsoft
CVE-2022-26925Windows LSA Spoofing Vulnerability
High 8.1 Exploited
In plain English
A high-severity missing authentication in Windows 10 Version 1507 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on July 1, 2022). The chance it is exploited in the next 30 days is estimated at 10.5% (higher than 96% of all known vulnerabilities). Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
CISA guidance
Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
Federal agencies must remediate by Jul 22, 2022.
Official description
Windows LSA Spoofing Vulnerability
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
References
- Windows LSA Spoofing Vulnerability vendor-advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26925 x_refsource_MISC, x_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26925 government-resource