CVE-2022-26923Certifried, AD CS certificate mapping privilege escalation
What broke
CVE-2022-26923 ("Certifried") lets a low-priv user obtain a certificate that AD will map to a more privileged computer or user account. Microsoft patched it in 2022 and later shipped strong certificate mapping (KB5014754). Rapid7 and Unit 42 still report it in 2025 incident response. CVSS 8.8.
Why it matters
This is the historical CVE we keep in a 2025-2026 identity catalog because the control is still missing in a lot of forests. The patch without enforcement mode is how Certifried stays a live path next to ESC15 and PKINIT.
What to do
- Confirm KB5014754 is in enforcement, not compatibility.
- Hunt for certificate logons whose SAN does not match the account they mapped to.
- Treat AD CS as tier-zero. The CA, the templates, and the NTAuth store belong on the same review as Domain Admins.
After you patch
Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.
- Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
- Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
- Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.
Sources
- NVD: CVE-2022-26923
- Microsoft KB5014754, strong certificate mapping
Related identity CVEs
Related on Start with Identity
- CVEPaperCut NG/MF improper authentication, still on CISA KEV
PaperCut NG/MF improper authentication. A 2023 CVE that remains on CISA KEV and in 2025-2026 ransomware playbooks. Print-management appliances keep getting trea
- CVEruby-saml 2024 auth bypass (ahacker1), still in the blast radius
The original 2024 ruby-saml authentication bypass (CVSS 10.0). It is outside the last twelve months, but every 2025 ruby-saml CVE is an incomplete-fix descendan
- RankingBest ITDR for Active Directory: Top 5 AD Security Platforms
The best ITDR platforms for Active Directory in 2026: Semperis, Microsoft Defender for Identity, Silverfort, Cayosoft, and Quest Change Auditor. Ranked for AD t
- GuideIAM Cloud Migration Guide: From On-Prem Active Directory to Cloud Identity
A practical guide to migrating from on-premises Active Directory to cloud IAM, covering hybrid identity architecture, migration phases, coexistence strategies,
- ArticleTop 5 Directory Services Solutions in 2026
Compare the top 5 directory services solutions in 2026, from Microsoft Active Directory and JumpCloud to OpenLDAP, for managing identities across your infrastru
- ArticleTop 6 Open-Source Directory Services and LDAP Servers
The best open-source directory servers in 2026, from OpenLDAP and 389 Directory Server to FreeIPA, Samba AD, Kanidm, and LLDAP, compared on protocol support, Ac
Technique
This CVE is an instance of AD CS certificate template abuse. A certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.