Starting in May 10, 2022, Windows security updates have addressed CVE-2022-34691, CVE-2022-26931, and CVE-2022-26923 following a timeline that includes a Compatibility mode, Full Enforcement mode and a Disable mode. By May 9, 2023, all servers that run Active Directory Certificate Services and Windows domain controllers will be updated to Full Enforcement mode. These CVEs address an elevation of privilege vulnerability that can occur when the Kerberos Distribution Center (KDC) is servicing a certificate-based authentication request.
Before the May 10, 2022, security update, certificate-based authentication would not account for a dollar sign ($) at the end of a machine name. This allowed related certificates to be emulated (spoofed) in various ways. See KB5014754 for detailed information.
When will this happen
We will update all devices to Full Enforcement mode by May 9, 2023.
Message ID: MC465515
Published: 2022-11-10
Updated: 2022-11-10
Action required by: 2023-05-09
Product: Office 365 general
Platform: World tenant
