AD CS CVE-2026-62818

The attacker must possess at least one valid low-privilege domain account (CVSS PR:L) and must have network connectivity to the AD CS server. No special AD CS configuration or non-default feature enablement is described as a prerequisite - the flaw is reachable through standard AD CS network interfaces available to any authenticated enrolling user. Limiting factors are: (1) authentication is required - unauthenticated external attackers cannot directly exploit this flaw; (2) the AD CS role must be installed and running on an affected Windows Server version; (3) network access to the AD CS host must be available to the attacker. In typical enterprise Active Directory environments, the PR:L requirement is met by every domain user and computer account, meaning the effective attacker population is the entire domain.

The CVSS 3.1 base score of 8.8 (High) is well-supported by the AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector: the flaw is network-reachable, requires no special conditions or user interaction, and demands only low-privilege credentials - a bar easily met by any domain-authenticated user in a typical enterprise. The full C:H/I:H/A:H impact triad reflects arbitrary code execution capability. No EPSS score was provided, so exploitation probability cannot be quantified beyond the CVSS signal; KEV status is negative, which tempers immediate urgency relative to confirmed in-the-wild exploitation. The tags list both memory corruption and denial of service, suggesting multiple exploitation outcomes may be possible depending on reliability. Even a mid-sized municipal IT team in boleslawiec should treat this as urgent given that AD CS is routinely network-accessible to the entire domain user population - making the PR:L requirement effectively no barrier in practice. The breadth of affected versions, covering every Windows Server release from 2012 to 2025 per EUVD-2026-56395, significantly amplifies organizational exposure.

An authenticated domain user with a standard low-privilege account sends a specially crafted network request to the AD CS enrollment service endpoint, triggering the use-after-free condition in the service process. The freed memory region is subsequently reallocated and manipulated by the attacker to redirect execution flow, achieving arbitrary code execution in the context of the AD CS service account. No public proof-of-concept exploit has been identified at time of analysis; however, the AC:L designation indicates that a reliable exploit would not require significant environmental precision once the vulnerability is understood.