Some May 2022 Microsoft Security Updates Are Leading to Authentication Failures

In the wake of Active Directory authentication failures caused by Microsoft’s May 2022 Patch Tuesday updates, the U.S. Cybersecurity and Infrastructure Security Agency has removed a Windows LSA spoofing zero day bug from its catalog of vulnerabilities agencies are required to patch.

The bug, CVE-2022-26925, is a Windows LSA spoofing flaw that was patched last week as part of Microsoft’s monthly security updates, but the patch is resulting in authentication failures when applied to domain controllers.

According to CISA’s advisory, the update could lead to authentication failures on the server or client for services including Network Policy Server (NPS), Routing and Remote access Service (RRAS), Radius, Extensible Authentication Protocol (EAP), and Protected Extensible Authentication Protocol (PEAP).

CISA says Microsoft notified it of the issue, which is related to how the mapping of certificates to machine accounts is being handled by the domain controller, per the agency’s advisory.

The issue affects only May 2022 Patch Tuesday updates installed on servers used as domain controllers, and organizations should continue to apply updates to client Windows devices and non-domain controller Windows Servers, CISA notes.

According to Zero Day Initiative, the bug Microsoft patched could lead to an NTLM relay attack. An unauthenticated attacker could force a domain controller to authenticate against another server using NTLM, but the attacker would need to be in the logical network path between the target and the resource requested.

Microsoft gave the bug a CVSS score of 9.8 when combined with NTLM relay attacks.

In addition to these issues, two other updates for elevation of privilege bugs in Windows Kerberos and Active Directory Domain Services ( CVE-2022-26931 and CVE-2022-26923, respectively) are also causing some service authentication issues when applied to Windows Server domain controllers, according to BleepingComputer.

Microsoft recommends manually mapping certificates to a machine account in Active Directory until those issues are fixed.