Microsoft AD CS Attacks in 2026: What Happened and How to Harden Your PKI 

A user gets a Microsoft Teams message from “IT Support,” opens Quick Assist, and hands over remote control of their laptop. A few steps later, the attacker is holding a certificate that authenticates as a domain controller. Microsoft described this chain in an October 30, 2026 report on two intrusions, and Active Directory Certificate Services (AD CS) was what made it possible. 

Key takeaways 

• Microsoft reported two 2026 intrusions where attackers posed as help desk staff on Teams, then abused AD CS misconfigurations known as ESC1 and ESC8 to reach domain-level privileges and, in one case, steal data. 

• Neither technique is new. ESC1, ESC8, and PetitPotam were all published in 2021, and many AD CS deployments still have not closed them. 

• Microsoft has also patched at least seven AD CS vulnerabilities in 2026, including Certighost (CVE-2026-54121, CVSS 8.8, fixed July 14, public proof-of-concept) and the remote code execution flaw CVE-2026-62818 (CVSS 8.8, fixed August 11). 

• The fix is a mix of patching, template cleanup, locking down web enrollment, and treating your Certificate Authority (CA) as a Tier 0 asset. 

What Microsoft reported: help desk impersonation leading to AD CS abuse 

On October 30, 2026, Microsoft published From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths, an analysis of two separate intrusions that followed the same playbook. Microsoft has not attributed the activity to a known threat actor, and no Teams vulnerability was involved. 

The initial access looked like this: 

1. Attackers contacted employees through Microsoft Teams chats and calls from external tenants with organization-themed names and support-style display names. 

2. They persuaded users to start a Quick Assist session, giving the attacker remote control of the workstation. 

3. Once connected, they dropped archives into the Downloads folder, extracted payloads into KB-prefixed folders under the user profile, and launched portable Python, Bun, or Java runtimes. 

4. Those scripts ran host discovery, connected to domain infrastructure over LDAPS and SMB, and checked the environment’s certificate services for weaknesses. 

That last step is the important one. The attackers were not looking for a zero-day. They were looking for an AD CS configuration that would hand them a certificate for someone more powerful than the user they had just tricked. 

How ESC1 and ESC8 turned a phishing call into domain admin 

ESC1 and ESC8 are two of the AD CS escalation paths first catalogued by SpecterOps in the 2021 research paper Certified Pre-Owned. Each intrusion in Microsoft’s report used one of them. 

Case 1: ESC1, a template that lets the requester choose the identity 

ESC1 is a certificate template misconfiguration. The template allows client authentication, lets the requester supply the subject name (so they can claim to be anyone), grants enrollment to broad groups such as Domain Users, and does not require manager approval. Any low-privileged user can then request a certificate that says “I am the domain admin” and use it to log in as that admin. 

In Microsoft’s first case: 

• Wave 1: Phishing targeted three users and compromised one workstation. The attacker obtained certificates for three highly privileged accounts. 

• DCSync: Within seconds of getting one privileged certificate, the attacker authenticated to a domain controller and ran DCSync, a technique that pulls password hashes by impersonating domain replication. 

• Wave 2: About 90 minutes after the first disruption, phishing targeted 16 more users, compromised a second workstation, and produced certificates for eight more privileged accounts. 

• Exfiltration: Automated attack disruption restricted remote logons and file share access for most of those identities, but one privileged account had been excluded from automated response. The attacker used it to reach a file server and ran a renamed copy of Rclone (disguised as SearchApp.exe) to copy files to an external SFTP server. 

Case 2: ESC8, NTLM relay to web enrollment 

ESC8 targets the AD CS Web Enrollment endpoint when it accepts NTLM authentication over plain HTTP, or over HTTPS without Extended Protection for Authentication (EPA). In the second case: 

1. The attacker used PetitPotam to force a domain controller to authenticate to an attacker-controlled host over EFSRPC. 

2. They relayed that NTLM authentication to AD CS Web Enrollment. 

3. The CA issued a certificate from the Domain Controller template. 

4. The attacker used that certificate with Kerberos PKINIT to get a ticket-granting ticket (TGT) for the domain controller’s machine identity. 

Microsoft Defender raised ESC8 alerts, the customer isolated the workstation, and Microsoft observed no further progression. 

	ESC1	ESC8
Weakness	Template lets requester set the subject, with broad enrollment rights	Web Enrollment accepts relayed NTLM over HTTP, or over HTTPS without EPA
What the attacker got	Certificates for privileged user accounts	A certificate for a domain controller
Outcome in Microsoft’s case	DCSync and data exfiltration	Stopped after alerts and isolation
Primary fix	Remove requester-supplied subjects, tighten enrollment, require approval	Enforce HTTPS and EPA, disable NTLM, follow KB5005413

One detail from the report deserves attention from every incident response team: resetting a password does not revoke a certificate, and revoking a certificate does not invalidate Kerberos tickets that were already issued with it. Both have to be handled separately. 

The 2026 AD CS vulnerabilities you need to patch 

Misconfigurations were not the only AD CS problem this year. Microsoft has patched at least seven AD CS vulnerabilities in 2026, and one of them, Certighost, now has public exploit code. The table compares Certighost with CVE-2026-62810, a privilege escalation on the CA server itself. The rest are listed after it. 

	Certighost (CVE-2026-54121)	CVE-2026-62810
Type	Improper authorization (CWE-285)	Heap-based buffer overflow
CVSS 3.1	8.8 High, network	7.8 High, local
Attacker needs	Any domain account and network access	A low-privileged local account on the AD CS host
Impact	Certificate for a domain controller, then DCSync and the krbtgt secret	Elevation of privilege on the CA server
Patched	July 14, 2026	September 8, 2026
Public exploit	Yes, released July 24, 2026	None reported
Advisory	MSRC CVE-2026-54121	MSRC CVE-2026-62810

Certighost (CVE-2026-54121) 

Certighost abuses an AD CS enrollment fallback called a “chase.” When the CA cannot find information about the requesting machine, a request can tell it which server to contact (the cdc attribute) and which machine object to look up (the rmd attribute). Before the July fix, the CA followed that requester-supplied server over SMB and LDAP without checking that it was a real domain controller. 

An attacker with an ordinary domain account can create a computer account (the default machine account quota is 10), point the CA at listeners they control, relay the CA’s authentication to the real domain controller, and walk away with a certificate that names the domain controller. From there it is PKINIT, DCSync, and the krbtgt secret, which means control of the domain. The public exploit relies on an Enterprise CA that allows enrollment from the default Machine template. The National Vulnerability Database entry lists Windows Server 2012 through Windows Server 2025, plus Windows 10 versions 1607 and 1809, as affected. 

As of early November 2026, Microsoft had not confirmed exploitation by threat actors, and the flaw was not in CISA’s Known Exploited Vulnerabilities catalog. With working exploit code public since July 24, that can change quickly. 

If you cannot patch right away, the researchers’ workaround is to clear the chase flag and restart Certificate Services from an elevated PowerShell prompt on the CA: 

certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC 

Restart-Service CertSvc -Force 

This was tested in a lab and can break legitimate enrollment flows, so stage it first. The July update is the permanent fix. 

CVE-2026-62810 

CVE-2026-62810 is a heap-based buffer overflow in AD CS that lets an authenticated local user elevate privileges on the CA host. It is less dramatic than Certighost because the attacker already needs a foothold on the server. Still, anyone who controls a CA server can issue certificates for any identity in the domain, so it belongs on the same patch list. 

Other AD CS vulnerabilities patched in 2026 

Microsoft also released these AD CS fixes in 2026: 

• CVE-2026-62818 (August 11, 2026): remote code execution through a use-after-free flaw, CVSS 8.8, rated Critical by Microsoft. An authenticated, low-privileged attacker on the network can trigger it. No public exploit has been reported. 

• CVE-2026-69821 (September 8, 2026): local elevation of privilege, CVSS 7.8. 

• CVE-2026-69395 (September 8, 2026): information disclosure over the network, CVSS 6.5. 

• CVE-2026-69624 (September 8, 2026): tampering over the network, CVSS 6.5. 

• CVE-2026-83666 (October 13, 2026): local elevation of privilege through a race condition, CVSS 7.0. 

Windows Server updates are cumulative, so installing the latest monthly update on every CA server covers all of them. 

Why attackers keep going after AD CS 

AD CS is attractive because a certificate is a credential that most defenses do not watch closely. Four things make it a reliable target: 

• Certificates outlive passwords: A stolen certificate keeps working after the victim’s password is reset. It stays valid until it expires or is revoked, and many authentication certificates are issued for a year or more. 

• The CA can mint any identity: An Enterprise CA trusted for smart card or PKINIT logon can issue a certificate for a domain admin or a domain controller. Whoever controls issuance controls the domain. 

• Templates drift: Templates get cloned for a one-off project, enrollment rights get widened to fix a ticket, and nobody revisits them. Five years later, one of them is ESC1. 

• AD CS is often nobody’s job: In many organizations the PKI was built by a consultant or an engineer who has since moved on. The Windows team patches the server, but no one owns template hygiene, enrollment endpoints, or CA audit logs. 

Attackers know this. Tools such as Certipy and Certify make finding a vulnerable template a single command, and in Microsoft’s cases the attackers’ scripts were assessing certificate services soon after they landed. 

AD CS hardening checklist 

Most of what stopped, or would have stopped, these attacks is configuration work you can start this week. If any CA exposes Web Enrollment with NTLM enabled, do steps 4 and 5 first. 

#	Action	Closes
1	Install the latest cumulative update on every AD CS host, which includes the July through October 2026 AD CS fixes. If patching is delayed, clear EDITF_ENABLECHASECLIENTDC as an interim step.	Certighost, CVE-2026-62818, and the other 2026 AD CS CVEs
2	Inventory every CA and every published template. Find templates that allow client authentication and let the requester supply the subject name.	ESC1
3	On those templates, remove the requester-supplied subject, restrict enrollment to named groups, and require CA manager approval where the use case allows it.	ESC1
4	Find every Web Enrollment and Certificate Enrollment Web Service endpoint. Remove the ones you do not need.	ESC8
5	On the endpoints you keep, require HTTPS, enforce Extended Protection for Authentication, and disable NTLM once Kerberos-only authentication is confirmed, per KB5005413.	ESC8, PetitPotam relay
6	Turn on Certification Services advanced auditing and send CA events (including 4886 and 4887) to your SIEM. Alert on certificates issued for privileged accounts or domain controllers from unexpected templates or requesters.	Detection for all of the above
7	Treat CA servers as Tier 0, with the same admin separation, access controls, and monitoring as domain controllers.	CVE-2026-62810, CA takeover
8	Write an incident playbook that covers certificate revocation, CRL publishing, and separate review of Kerberos tickets already issued. Make sure no privileged account is silently excluded from automated containment.	Response gaps seen in Case 1

On the user side, verify unsolicited support requests through a known internal channel, restrict external Teams access to tenants you trust, limit remote-support tools to an approved list, and use application control to block portable runtimes launched from user-writable folders. Those steps would have broken the chain before AD CS ever came into play. 

Our take: what we would actually recommend 

Patching Certighost is the easy part. The harder lesson from Microsoft’s report is that the attackers did not need Certighost at all. A template misconfiguration and an unprotected enrollment endpoint, both documented in 2021, were enough. 

Here is how we would prioritize if we were running your PKI tomorrow: 

1. Treat NTLM-enabled Web Enrollment as an emergency: If any CA in your forest exposes Web Enrollment over HTTP or without EPA, ESC8 is one PetitPotam call away. Fix that before anything else on the list, including template work. 

2. Give AD CS an owner: A common pattern is a CA that is patched by the server team and secured by no one. Someone needs to own template changes, enrollment rights, and CA audit logs, with a review at least once a year. 

3. Assume your templates have drifted: An AD CS environment that has run for several years usually has templates nobody can explain. Run a template audit with Certipy or Microsoft Defender for Identity’s AD CS posture assessments, then fix what you find instead of filing the report. 

4. Plan for certificate-based incidents: Most incident playbooks reset passwords and stop there. Microsoft’s Case 1 shows why that is not enough: certificates survive password resets, and one excluded account kept the attacker in the network. 

5. Ask whether you should be running the CA yourself: For organizations without dedicated PKI staff, operating an internal Enterprise CA means owning patching, hardening, HSM integration, and monitoring forever. Moving issuance to a managed PKI removes much of that attack surface. 

None of this is new advice, and that is the point. AD CS attacks keep working because the fixes were published in 2021 and many environments still have not applied them. 

How Encryption Consulting can help 

Whether you keep AD CS or move away from it, Encryption Consulting can take on the work described above. 

• PKI Assessment: A review of your CA hierarchy, certificate lifecycle processes, key storage, and CP/CPS, ending in a gap analysis and a prioritized remediation roadmap. It is a practical first step toward finding out whether your environment has the weaknesses Microsoft described. 

• PKI Support Services: 24/7 access to PKI experts, including help with Microsoft AD CS certificate templates, HSM integration with AD CS, and support during critical incidents. 

• PKI-as-a-Service: A single-tenant private PKI built and operated by Encryption Consulting, backed by FIPS 140-3 Level 3 HSMs, with policy workflows and audit trails for every certificate. You keep ownership of the CA and its keys without running the infrastructure yourself. 

• CertSecure Manager: Continuous discovery and management of certificates across Microsoft CAs, public CAs, and private CAs from a single dashboard, with audit trails and high-risk certificate reports that make it easier to spot and revoke certificates that should not exist. 

For deeper reading, see our earlier post on Mitigating ESC1 and ESC8 Vulnerability in Active Directory, the AD CS Template Hardening: ESC1 to ESC16 Defense Playbook, the Windows Server PKI and AD CS Hotfix Reference Guide, and Replacing Microsoft AD CS with PKIaaS: Migration Strategy and Pitfalls. New to AD CS? Start with our Education Center guide to Microsoft AD CS. 

Encryption Consulting is ISO/IEC 27001:2022 certified and SOC 2 compliant. Talk to our PKI experts about an AD CS assessment and find out where your CA stands before an attacker does. 

Conclusion 

The 2026 AD CS attacks did not depend on a clever exploit. They started with a Teams message and a Quick Assist session, then used template and enrollment weaknesses that have been documented since 2021. Certighost shows that even a well-configured CA needs prompt patching, and CVE-2026-62810 is a reminder that the CA server itself is a Tier 0 asset. 

If you do one thing this month, find out whether any of your CAs expose Web Enrollment with NTLM enabled, and whether any template lets a requester choose who the certificate is for. Those two answers will tell you how close you are to the intrusions Microsoft just described. 

Frequently asked questions 

What is an AD CS attack? 

An AD CS attack abuses Microsoft Active Directory Certificate Services to obtain a certificate for an identity the attacker does not control, such as a domain admin or a domain controller. The attacker then uses that certificate to authenticate through Kerberos PKINIT. Common paths include misconfigured templates (ESC1), NTLM relay to web enrollment (ESC8), and vulnerabilities such as Certighost (CVE-2026-54121). 

What is Certighost (CVE-2026-54121)? 

Certighost is an improper authorization flaw in AD CS, rated CVSS 8.8, that Microsoft patched on July 14, 2026. It lets an attacker with an ordinary domain account trick the CA into issuing a certificate for a domain controller by abusing the enrollment “chase” feature. Public exploit code was released on July 24, 2026. 

How do I know if my AD CS environment is vulnerable to ESC1 or ESC8? 

For ESC1, look for templates that allow client authentication, let the requester supply the subject name, and grant enrollment to broad groups. For ESC8, check whether any Web Enrollment endpoint accepts NTLM over HTTP or without Extended Protection for Authentication. Tools such as Certipy and Microsoft Defender for Identity can flag both. 

Does resetting a password stop an AD CS attack? 

No. A certificate issued to an attacker keeps working after the account’s password is reset. You must revoke the certificate and publish an updated CRL. Revocation also does not cancel Kerberos tickets the attacker already obtained, so those tickets must be investigated and handled separately. 

Should we replace AD CS with a managed PKI? 

It depends on whether you have the staff to own AD CS security long term. Running an internal Enterprise CA means continuous patching, template governance, HSM management, and monitoring. Organizations without dedicated PKI staff often reduce risk by moving issuan