Ly4K

The issue is related to insufficient access restrictions in the Active Directory Domain Services of the Windows operating system. It allows a remote attacker to elevate their privileges.

The issue is related to insufficient access control in the Windows Print Spooler, which can be exploited to elevate privileges. This allows an attacker to affect the system. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

**Active Directory Domain Services and Certificate Services** (affected versions not specified) **Description:** This issue involves an elevation of privilege vulnerability affecting Active Directory Domain Services and Certificate Services. Successful exploitation allows attackers to impact the system and potentially gain control of the domain. The vulnerability stems from improper authorization within the certificate services, enabling attackers to create machine accounts and perform Kerberoasting attacks to extract service account credentials from domain controllers. Exploitation requires authentication and involves manipulating certificate requests to obtain certificates with elevated privileges. Recent reports indicate that cybercriminals are actively exploiting this issue, often in conjunction with social engineering tactics, to compromise systems and escalate privileges. The vulnerability, also known as "Certifried," allows attackers to add a computer to the domain and subsequently extract NTLM hashes, potentially leading to domain takeover. Several sophisticated intrusion attempts have been linked to this vulnerability, with attackers adapting their techniques to bypass security measures. **Recommendations:** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient protection of service data in the Windows Print Spooler, which can allow an attacker to gain unauthorized access to protected information. This can lead to the disclosure of sensitive information and potentially affect the system. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.