OTPulse

Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-69821Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Improper encoding or escaping of output in Active Directory Certificate Services (AD CS) allows an authorized user with local access to escalate privileges to SYSTEM level. This affects Windows 10 versions 1607 and 1809, and Windows Server 2016, 2019, 2022, and 2025. Exploitation is considered unlikely but would allow an attacker to issue unauthorized certificates, potentially compromising certificate-based authentication used by industrial control devices and networked OT systems.

What this means
What could happen
A user with local access to a Windows system running AD CS could escalate their privileges to system level, potentially gaining control of certificate issuance and authentication infrastructure used across the organization's network and OT systems.
Who's at risk
Organizations running Active Directory Certificate Services on Windows 10 (versions 1607 and 1809), Windows Server 2016, 2019, 2022, or 2025 are affected. This impacts any organization that issues or relies on digital certificates for authentication of network devices, industrial controllers, field instrumentation, or secure communications in OT environments.
How it could be exploited
An attacker with local user credentials on a Windows server running AD CS can exploit improper output encoding to escalate privileges to SYSTEM. Once elevated, the attacker could issue fraudulent certificates, intercept OT communications, or compromise domain authentication used by industrial controllers and field devices.
Prerequisites
  • Local user account on a Windows server with AD CS installed
  • Access to the affected Windows system (physical or RDP/console session)
Low complexity attackRequires local access (not remotely exploitable)Affects centralized authentication infrastructure used by OT devices
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5622
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33438
Windows Server 2025All versionsBuild 10.0.26100.33438
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict local console and remote desktop access to Windows servers running AD CS to only authorized administrators
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply Microsoft September 2026 security update to all Windows 10, Windows Server 2016, 2019, 2022, and 2025 systems running Active Directory Certificate Services
All products
HARDENINGReview and audit local user accounts on all AD CS servers; remove or disable unnecessary local accounts
View full vendor advisory
API: /api/v1/advisories/4cef4308-f037-422b-a9d3-c26b68fb4784

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability | CVSS 7.8 - OTPulse