CISA orders federal agencies to patch CVE-2022-26925 by July 22

The flaw is a Windows LSA Spoofing vulnerability actively exploited in the wild. The vulnerability can be exploited by an unauthenticated attacker to force a domain controller to authenticate against another server using NTLM.