Windows AD CS EUVD-2026-73369

The Active Directory Certificate Services server role must be explicitly installed and running on the target host - it is not present in a default Windows installation and must be added by an administrator. The attacker must hold a valid, locally authenticated low-privilege session on that specific host, consistent with the PR:L metric in the CVSS vector. No user interaction is required once local access is established (UI:N). Exploitation is limited by: the requirement for the AD CS role to be present, the need for an attacker to already hold low-privilege credentials on that host, and the local attack vector (AV:L) meaning no direct unauthenticated remote exploitation path exists. There are no additional non-default configuration settings cited in the description as prerequisites beyond the presence of the AD CS role itself.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat profile: local, low-privilege entry with full CIA impact and no user interaction required. The local attack vector limits direct internet exposure, but AD CS servers are high-value targets in enterprise Active Directory environments - a compromise grants control over certificate issuance, enabling downstream lateral movement via forged certificates (pass-the-certificate, NTLM relay, or golden-certificate attacks against the entire domain). No EPSS data was included in the input; the absence of a KEV listing and POC reduces the urgency somewhat compared to a confirmed in-the-wild exploit, but the AC:L rating means exploitation is not technically demanding once local access is established, so even a municipal IT team in sanok managing domain infrastructure should treat patching AD CS hosts as a priority given the choke-point role these servers play in Active Directory trust hierarchies. The breadth of affected versions - Server 2012 through 2025, plus Windows 10/11 - substantially widens the aggregate exposed population.

An attacker who has obtained a low-privileged Windows account on a server running the AD CS role crafts a malformed request to a vulnerable AD CS component, triggering a heap buffer overflow that corrupts heap metadata. The overflow redirects execution flow to attacker-controlled code running at an elevated privilege level, yielding SYSTEM access. With SYSTEM privileges on an AD CS server the attacker can issue fraudulent certificates, enabling impersonation of any domain principal and lateral movement throughout the Active Directory environment.