AD CS EUVD-2026-73692

Exploitation requires a valid low-privilege domain account (PR:L) and network-level access to a Windows Server system with the Active Directory Certificate Services role installed and the CA enrollment service reachable over the network (AV:N). The AD CS role is not installed by default; it must be explicitly enabled on a Windows Server. No user interaction is required once the attacker can reach the enrollment endpoint. Exploitation is limited to environments where AD CS is deployed, the attacker holds at least domain-user credentials, and the targeted AD CS enrollment endpoint is network-accessible from the attacker's position. High-confidentiality impact is bounded to information readable from the AD CS process's memory; no integrity or availability impact has been established.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-exploitable flaw requiring only low-privilege credentials with no user interaction, delivering high confidentiality impact. The PR:L prerequisite is a meaningful barrier in environments with strict credential hygiene but is easily satisfied by any domain-authenticated user in typical enterprise Active Directory deployments. The C:H rating warrants attention given AD CS's central role in PKI trust: leaked memory could expose certificate-related secrets, affecting downstream services that depend on PKI integrity. No KEV listing, no EPSS data, and no public POC were found in the provided intelligence, which moderates immediate urgency. However, the breadth of affected Windows Server versions (2012-2025) and Windows 10 1607/1809 endpoints with the AD CS role installed represents significant attack surface in enterprise environments. The absence of integrity or availability impact (I:N/A:N) limits this to an information-disclosure class, but in PKI-heavy environments, confidentiality of certificate infrastructure data can be operationally critical.

An authenticated domain user with no elevated privileges sends a specially crafted certificate request or enrollment message to an AD CS enrollment endpoint, embedding format string directives (%x, %s) in a controllable string field. The AD CS process passes this input unsanitized to an internal format function, causing it to read and return process memory contents in the response. The attacker parses the response to extract potentially sensitive data from the AD CS service's memory space.