Active Directory Certificate Services EUVD-2026-44139

The environment must run the AD CS Certification Authority role (an enterprise CA) reachable over the network by the attacker, and the attacker must hold a valid low-privileged authenticated domain identity (CVSS PR:L) - this is not exploitable by a fully unauthenticated outsider. Exploitation targets the certificate authorization/enrollment path, so realistic risk further depends on the CA having enrollable templates the flawed authorization check applies to. Limiting factors: requires existing domain authentication, network reachability to the CA enrollment interface, and a deployed AD CS role (organizations without AD CS are not affected). No user interaction and low complexity mean that, given those prerequisites, exploitation is straightforward.

This is a genuine prioritization candidate, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates network reachability, low attack complexity, no user interaction, and only low pre-existing privilege (any authenticated domain user) with full CIA impact - a favorable profile for attackers who already have a foothold. EPSS and SSVC decision data were not provided in the input, so exploitation-probability and automatability cannot be quantified here. It is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation yet; however, AD CS is a heavily targeted post-compromise pivot and historically similar authorization/ESC flaws have been rapidly weaponized. The main limiting factor is that the attacker needs existing authenticated access (PR:L) rather than being fully unauthenticated. Note: the description says 'authorized attacker' which is consistent with PR:L in the vector - no conflict between the CVSS vector and the narrative.

An attacker who has compromised or been granted a low-privilege domain account connects over the network to the enterprise AD CS Certification Authority and submits a crafted certificate request that the improper authorization check fails to reject. The issued certificate grants authentication as a higher-privileged principal, which the attacker then uses to escalate toward domain administrator. No user interaction is required and attack complexity is low; no public POC is currently referenced.