CVE-2022-38042

Deeper analysis

CVE-2022-38042 is an elevation of privilege vulnerability affecting Active Directory Domain Services. The flaw received a CVSS 3.1 base score of 7.1 with a network attack vector, high attack complexity, low privileges required, and required user interaction, resulting in high impact to confidentiality, integrity, and availability.

An authenticated attacker who already possesses a low-privileged domain account could exploit the issue to obtain higher privileges within the domain. Successful exploitation would allow the attacker to perform actions that are normally restricted to more privileged accounts, such as domain administrators.

Microsoft has published security guidance for the vulnerability through its Security Response Center at the referenced URLs, directing administrators to the corresponding updates and configuration recommendations.

The associated EPSS score has remained flat at 0.0578 with no material increase since disclosure, indicating limited observed exploitation interest to date.