What is the CVSS score of EUVD-2026-44139?

EUVD-2026-44139 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Active Directory Certificate Services are affected by EUVD-2026-44139?

A privilege escalation flaw in Microsoft Active Directory Certificate Services allows low-privileged domain users to gain administrative access, directly threatening the security of identity-based…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-44139?

Yes, a public proof-of-concept exploit is available for EUVD-2026-44139. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate EUVD-2026-44139?

Within 24 hours, identify all Windows Server instances running AD CS Certificate Authority roles and document their current patch levels. Within 7 days, obtain the vendor-released patch from Microsoft and validate it in a test AD CS environment, confirming certificate request and enrollment workflows function correctly. Within 30 days, deploy the patch across all production AD CS servers prioritizing domain controllers, then verify through certificate auditing that low-privileged users can no longer request elevated-permission certificates.

Active Directory Certificate Services EUVD-2026-44139

| CVE-2026-54121 HIGH

Improper Authorization (CWE-285)

2026-07-14 microsoft

GHSA-64qv-2ffq-h4w6

Authentication Bypass Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable AD CS enrollment abusable by any authenticated low-privilege domain user with no interaction, yielding privileged access with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:37 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 8.8

DescriptionCVE.org

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Active Directory Certificate Services (AD CS) allows an authenticated network attacker to elevate privileges due to improper authorization (CWE-285) in certificate request/enrollment handling across Windows Server 2012 through 2025 and their Server Core installations. With a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) and full high impact to confidentiality, integrity, and availability, a low-privileged domain user can abuse AD CS authorization checks to gain elevated rights, potentially up to domain compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but AD CS abuse (ESC-class attacks) is a well-established, high-value target class.

Technical ContextAI

AD CS is the Microsoft PKI role that issues and manages X.509 certificates within an Active Directory forest, underpinning smartcard logon, authentication, code signing, and encryption. The weakness is classed as CWE-285 (Improper Authorization), meaning the service performs an action or issues/validates a certificate without correctly verifying that the requesting principal is authorized for it - the recognized failure mode behind the ESC family of AD CS escalation techniques where enrollment/template/authorization controls can be bypassed to obtain a certificate granting rights the requester should not have. The CPE set identifies affected components as Microsoft Windows Server 2012, 2012 R2, 2016, 2019 (including Server Core installations), plus tags extending to Windows Server 2022 and 2025, and Windows 10 Version 1607/1809 clients, i.e. systems running or interacting with the AD CS Certification Authority role. Because certificates issued by a trusted enterprise CA are honored domain-wide, an authorization flaw here has forest-level blast radius.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-54121 for each affected OS as listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121 (exact fixed build numbers are enumerated per product in the MSRC update guide; no standalone version string was provided in the input, so cite the KB from the advisory for your specific OS). Prioritize patching the CA servers themselves. As compensating controls until patched, audit and tighten certificate template permissions and enrollment rights (remove overly permissive Enroll/AutoEnroll grants and 'Supply in the request' subject settings), disable or restrict vulnerable/unused templates, enable CA audit logging (event IDs for certificate issuance) and monitor for anomalous enrollment, and restrict network access to the CA's enrollment endpoints (e.g. Web Enrollment / RPC certificate services) to trusted management hosts. Trade-off: tightening template permissions and disabling templates can break legitimate auto-enrollment and smartcard workflows, so validate against your PKI dependencies before enforcing.