CVE-2026-69821

CVE-2026-69821 is an improper output encoding or escaping flaw (CWE-116) in Microsoft Active Directory Certificate Services (AD CS), the Windows Server role that issues and manages certificates in enterprise Active Directory environments. The flaw is triggered by an authorized, low-privileged attacker who already has local access to an affected system, requires no user interaction, and exploits AD CS failing to correctly encode or escape output it processes. Successful exploitation elevates the attacker's privileges locally on the affected server, with CVSS scoring high impact to confidentiality, integrity, and availability; because CA servers are trusted to issue domain-valid certificates, compromising one can be a stepping stone to broader domain compromise. Any organization running the AD CS role on Windows Server — effectively most enterprises that rely on Active Directory certificate authentication — is affected. There is no evidence of exploitation so far: no public proof-of-concept exists, the flaw is not in CISA's KEV, EPSS puts the 30-day exploitation probability at just 0.3%, and the fix shipped in Microsoft's September 2026 Patch Tuesday release.

What to do: Inventory which Windows Servers host the AD CS role, then apply Microsoft's September 2026 Patch Tuesday security updates to all of them, prioritizing enterprise/issuing CAs and any CA reachable over the network. As an interim mitigation, restrict interactive logon and other local access rights on CA servers to administrators only; since there is no public PoC, this can follow your normal patch cycle, but do not defer past your standard 2-4 week window and monitor the Microsoft advisory for updates.