AI analysis
CVE-2026-83666 is a race condition (CWE-362) in Microsoft Active Directory Certificate Services in which concurrent use of a shared resource is not properly synchronized. An attacker who already has authorized local access with low privileges can trigger the race—high attack complexity, no user interaction—to elevate privileges on the host. Successful exploitation has high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.0, AV:L/AC:H/PR:L/UI:N/S:U). Organizations that run the AD CS role on Windows Server, typically as enterprise certificate authorities, are affected; Microsoft assigned the CVE and it is tied to the October 2026 Patch Tuesday updates. It is not in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Install Microsoft’s October 2026 security updates on every Windows Server that has the Active Directory Certificate Services role, after normal change validation. Until those updates are applied, limit local and interactive logon on certification-authority hosts to administrators who need it, and treat CA servers as high-priority patch targets because local privilege escalation there can affect the enterprise PKI.
Affected
| Microsoft Active Directory Certificate Services (AD CS) | Windows Server installations with the AD CS role covered by the October 2026 security updates; specific build numbers were not included in the supplied data |
Estimated exposure
largeon the order of 100,000+ Windows Server systems running the AD CS role — Estimate from typical enterprise deployment of the optional AD CS Certification Authority role on Windows Server, not from a public internet scan; the role is common where organizations run Microsoft PKI but is not installed on every…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.