AD CS EUVD-2026-99320

The target must have the Active Directory Certificate Services (AD CS) role installed and running. The attacker must already possess a local authenticated low-privileged account (PR:L) on that host - this is not remotely reachable (AV:L) and requires no victim interaction (UI:N). The decisive limiting factor is the high attack complexity (AC:H): success depends on winning a narrow, timing-dependent race condition in a shared resource, so exploitation is non-deterministic and may require many attempts, which is why CISA SSVC rates it non-automatable. Hosts without the AD CS role are not affected.

Signals point to a genuine but non-urgent local elevation-of-privilege issue. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes a locally-exploitable flaw requiring an already-authenticated low-privileged user and a high-complexity race window, yielding full confidentiality, integrity and availability impact (SYSTEM-level) with no scope change. CISA SSVC reinforces lower urgency: Exploitation 'none', Automatable 'no', Technical Impact 'total' - i.e. severe if exploited but not currently seen in attacks and not amenable to mass automation (consistent with AC:H and the need for prior local access). No EPSS score was supplied, the CVE is not on CISA KEV, and no public exploit was provided, so exploitation probability cannot be quantified from the data. The 'total' technical impact aligns with the C:H/I:H/A:H rating, and nothing in the signals conflicts. Net: a real patch-management priority for AD CS/CA hosts as a post-compromise privilege-escalation primitive, but not a drop-everything internet-facing emergency, since it needs local authenticated access and a difficult race to win.

A low-privileged authenticated user on a Windows Server running the AD CS role repeatedly triggers concurrent operations against a shared resource that is synchronized improperly, racing to corrupt state during a narrow timing window. Winning the race lets the attacker elevate to SYSTEM-level privileges on the certificate services host. No public exploit code was identified, and the high attack complexity means each attempt may fail, reducing reliability.