AD CS CVE-2026-69821

The attacker must have an authenticated low-privileged session on the affected host - specifically a machine running the Active Directory Certificate Services role. Authentication is confirmed by the CVSS PR:L metric. The AD CS role must be installed and running (it is not present in default Windows installations; it requires explicit server role deployment). No network exposure is required; the exploit is executed locally. Limiting factors: exploitation is constrained to systems where AD CS is installed; standard Windows workstations and servers without the certificate services role are not affected. The attack is further limited to users who can log on locally or via remote desktop to the AD CS server, which in hardened environments should be restricted to PKI administrators only.

The CVSS 7.8 score is well-calibrated: AV:L requires the attacker to already have local code execution, PR:L confirms a low-privileged authenticated account is sufficient, and the C:H/I:H/A:H triad reflects a complete local privilege escalation to SYSTEM or equivalent. No KEV listing and no confirmed POC reduce urgency compared to network-exploitable vulnerabilities, but AC:L and PR:L together mean that any authenticated user on an AD CS host can likely exploit this without sophisticated tooling. AD CS servers are high-value targets - they underpin PKI trust for entire domains - so post-compromise impact extends well beyond the individual server. EPSS data is absent from the provided intelligence, leaving exploitation probability unquantified. The 'Information Disclosure' tag in the input metadata is a mislabel; the CVSS C:H/I:H/A:H and the description's 'elevate privileges' language confirm this is a privilege escalation, not solely an information disclosure.

An attacker who has obtained a low-privileged domain user account (e.g., via phishing or credential stuffing) logs on locally or via RDP to a Windows Server running AD CS. By submitting a crafted certificate request or interacting with the AD CS management interface with specially constructed output-triggering input, the attacker exploits the improper encoding flaw to break out of the normal execution context and execute code as SYSTEM, gaining full control of the PKI server and the ability to issue rogue certificates for the domain. No public POC has been confirmed at time of analysis.