EUVD-2026-44139
GHSA-64qv-2ffq-h4w6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable AD CS enrollment abusable by any authenticated low-privilege domain user with no interaction, yielding privileged access with full CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Active Directory Certificate Services (AD CS) allows an authenticated network attacker to elevate privileges due to improper authorization (CWE-285) in certificate request/enrollment handling across Windows Server 2012 through 2025 and their Server Core installations. With a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) and full high impact to confidentiality, integrity, and availability, a low-privileged domain user can abuse AD CS authorization checks to gain elevated rights, potentially up to domain compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but AD CS abuse (ESC-class attacks) is a well-established, high-value target class.
Technical ContextAI
AD CS is the Microsoft PKI role that issues and manages X.509 certificates within an Active Directory forest, underpinning smartcard logon, authentication, code signing, and encryption. The weakness is classed as CWE-285 (Improper Authorization), meaning the service performs an action or issues/validates a certificate without correctly verifying that the requesting principal is authorized for it - the recognized failure mode behind the ESC family of AD CS escalation techniques where enrollment/template/authorization controls can be bypassed to obtain a certificate granting rights the requester should not have. The CPE set identifies affected components as Microsoft Windows Server 2012, 2012 R2, 2016, 2019 (including Server Core installations), plus tags extending to Windows Server 2022 and 2025, and Windows 10 Version 1607/1809 clients, i.e. systems running or interacting with the AD CS Certification Authority role. Because certificates issued by a trusted enterprise CA are honored domain-wide, an authorization flaw here has forest-level blast radius.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-54121 for each affected OS as listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121 (exact fixed build numbers are enumerated per product in the MSRC update guide; no standalone version string was provided in the input, so cite the KB from the advisory for your specific OS). Prioritize patching the CA servers themselves. As compensating controls until patched, audit and tighten certificate template permissions and enrollment rights (remove overly permissive Enroll/AutoEnroll grants and 'Supply in the request' subject settings), disable or restrict vulnerable/unused templates, enable CA audit logging (event IDs for certificate issuance) and monitor for anomalous enrollment, and restrict network access to the CA's enrollment endpoints (e.g. Web Enrollment / RPC certificate services) to trusted management hosts. Trade-off: tightening template permissions and disabling templates can break legitimate auto-enrollment and smartcard workflows, so validate against your PKI dependencies before enforcing.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today