CVE-2026-69624

CVE-2026-69624 is an incomplete list of disallowed inputs (CWE-184) in Microsoft Active Directory Certificate Services (AD CS), the Windows Server role that issues and manages digital certificates for Active Directory environments. A network-based attacker who already holds a valid low-privileged (authorized) account can send crafted input that bypasses the flawed disallow list, with no user interaction required. The impact is confined to integrity (CVSS: no confidentiality loss, no availability loss, high integrity impact), meaning the attacker can tamper with certificate-services state or data rather than read secrets or disrupt the service. Any organization running the AD CS role on Windows Server is potentially affected, though exploitation requires authenticated access rather than anonymous internet reachability. As of the September 2026 Patch Tuesday release — which fixed 966 flaws including 2 zero-days — there is no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS estimates only a 0.7% chance of exploitation in the next 30 days.

What to do: Apply Microsoft's September 2026 Patch Tuesday security updates to every Windows Server hosting the AD CS role, prioritizing root and issuing CAs. In the interim, review and restrict certificate-enrollment and template permissions for low-privileged accounts, since exploitation requires authenticated access, and monitor CA logs for unexpected certificate or configuration changes. Confirm post-patch that certificate issuance and template settings are intact, given the tampering-only impact.