CVE-2022-37976: Active Directory Certificate Services Elevation of Privilege Vulnerability

CVE-2022-37976 is an elevation of privilege vulnerability in Active Directory Certificate Services, rated Critical by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 2.39% probability of exploitation activity in the next 30 days, higher than 84% of all scored vulnerabilities. Microsoft released the fix on 11 October 2022 in the October 2022 Patch Tuesday, delivered through 11 security updates (KB5018419, KB5018421, KB5018411, KB5018450 and more). It affects 16 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2022-37976

Severity

High CVSS 8.8

Microsoft severity

Critical

Impact

Elevation of Privilege

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

EPSS

2.39% (percentile 84%)

CISA KEV

Not listed

Released

11 October 2022

Last updated

18 October 2022

Patch Tuesday

October 2022 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2022-37976 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Frequently asked questions (Microsoft)

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could gain domain administrator privileges.

How could an attacker exploit this vulnerability?

A malicious DCOM client could coerce a DCOM server to authenticate to it through the Active Directory Certificate Service (ADCS), and use the credential to launch a cross-protocol attack.

Mitigations and workarounds

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors might be helpful in your situation:

A system is vulnerable only if both the Active Directory Certificate Services role and the Active Directory Domain Services role are installed on a server in the network. Note that they would not necessarily need to be on the same server.

The following mitigating factors might be helpful in your situation:

Setting LegacyAuthenticationLevel - Win32 apps | Microsoft Docs to 5= RPC_C_AUTHN_LEVEL_PKT_INTEGRITY might protect most processes on the machine against this attack. Note that COM does not currently have a notion of minimum authentication level if authenticated, for example it is not possible to accept calls at RPC_C_AUTHN_LEVEL_NONE or >= RPC_C_AUTHN_LEVEL_PKT_INTEGRITY (server-side concern, but mentioning for completeness as it limits configuration-based options), nor is there a way to set the client-side authentication level for a process independent of the server-side authentication level. See LegacyAuthenticationLevel for more information about this value.

For information on how to set the applicable system-wide registry value see the Setting System-Wide Default Authentication Level section of Setting System-Wide Security Using DCOMCNFG.

Affected products (16)

Windows

ESU

Security updates (11)

• KB5018419 (Security Update)
• KB5018421 (Security Update)
• KB5018411 (Security Update)
• KB5018450 (Monthly Rollup)
• KB5018446 (Security Only)
• KB5018454 (Monthly Rollup)
• KB5018479 (Security Only)
• KB5018457 (Monthly Rollup)
• KB5018478 (Security Only)
• KB5018474 (Monthly Rollup)
• KB5018476 (Security Only)

NIST NVD data

NVD status

Modified

NVD CVSS

8.8 (HIGH)

Published to NVD

11 October 2022

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37976
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37976 (Patch, Vendor Advisory)

Acknowledgments

• Anonymous

Revision history

Related vulnerabilities

Other Active Directory Certificate Services vulnerabilities

• CVE-2026-54121: Active Directory Certificate Services Elevation of Privilege Vulnerability (High, CVSS 8.8, July 2026)
• CVE-2025-27740: Active Directory Certificate Services Elevation of Privilege Vulnerability (High, CVSS 8.8, April 2025)
• CVE-2024-49019: Active Directory Certificate Services Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2024)

More from the October 2022 Patch Tuesday

• CVE-2022-41033: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7.8, exploited)
• CVE-2022-37970: Windows DWM Core Library Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37987: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37989: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37997: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38028: Windows Print Spooler Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38050: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38051: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-34689: Windows CryptoAPI Spoofing Vulnerability (High, CVSS 7.5)
• CVE-2022-37974: Windows Mixed Reality Developer Tools Information Disclosure Vulnerability (Medium, CVSS 6.5)
• CVE-2022-37975: Windows Group Policy Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2022-37982: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (High, CVSS 8.8)

All vulnerabilities of this release: October 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-37976
• NIST NVD: CVE-2022-37976
• CVE.org record: CVE-2022-37976