CVE-2014-1812

Microsoft Windows Active Directory's Group Policy Preferences stores passwords deployed by administrators (for local accounts, services, and scheduled tasks) in XML files under SYSVOL, encrypted with a single, publicly documented AES key shared by every domain. Any authenticated domain user can read those SYSVOL preference files and decrypt the stored 'cpassword' values, recovering credentials for privileged accounts. With those credentials, an attacker can elevate privileges on the domain and move laterally, as observed in ransomware campaigns. The flaw affects Microsoft Windows environments in which Group Policy Preferences was ever used to distribute passwords, and previously issued passwords remain recoverable even after systems are patched unless rotated. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, and EPSS estimates a 65.1% probability of exploitation within 30 days (99th percentile).

What to do: Apply the vendor updates per CISA's required action (Microsoft bulletin MS14-025) on domain controllers and all Windows clients. Audit SYSVOL for preference XML files containing 'cpassword' (Groups.xml, Services.xml, ScheduledTasks.xml, DataSources.xml, etc.) and rotate every password that was ever distributed via Group Policy Preferences, since prior credentials remain decryptable with the public key even after patching. Going forward, avoid GPP-stored passwords and use alternatives such as Microsoft LAPS for local administrator credentials.