CVE-2022-35759
Published: 31 May 2023
Summary
CVE-2022-35759 is a medium-severity an unspecified weakness vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35759 is a denial-of-service vulnerability in the Windows Local Security Authority (LSA) component. It affects multiple versions of Windows Server and Windows client operating systems and carries a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, and low required privileges while impacting only availability.
An authenticated attacker with low privileges can send specially crafted requests over the network to trigger the flaw, causing the LSA process to stop responding and thereby disrupting authentication and security services on the target system without any user interaction required.
Microsoft’s security update guide entries for CVE-2022-35759 direct administrators to apply the patches released in the corresponding monthly security update; the updates address the root cause and are listed as available for all supported affected versions.
The EPSS score for this CVE stands at 0.2376 with no indicated rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38632
Vulnerability details
Windows Local Security Authority (LSA) Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.