CVE-2026-62818: Windows Active Directory Certificate Services (AD CS) Remote Code Execution

HERMES

HERMES THREAT SCORE & PKI IDENTITY INFRASTRUCTURE TAKEOVER

Target: Active Directory Certificate Services (certsrv.exe / certcli.dll)

Confidence: 94%

92 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 17 / 20

Threat Activity 16 / 20

Weaponization 18 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-62818 at 8.8 (HIGH, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score elevates operational risk to 92 (CRITICAL) because enterprise PKI compromise allows arbitrary digital certificate forging, leading directly to forest-wide identity spoofing via Kerberos PKINIT.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-62818: Windows Active Directory Certificate Services (AD CS) Remote Code ExecutionVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Technical Context & Affected Software Matrix

Active Directory Certificate Services (AD CS) provides public key infrastructure (PKI) for enterprise identity, smart card authentication, and TLS services.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	`CVE-2026-62818`	MSRC Bulletin August 2026
Vulnerable Component	`Active Directory Certificate Services (certsrv.exe / certenc.dll)`	Tier-0 Enterprise Public Key Infrastructure (PKI)
CWE Weakness	`CWE-416: Use After Free`	Dangling pointer dereference during certificate extension processing
CVSS v3.1 Score	8.8 (HIGH / Operational Severity CRITICAL)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
Authentication Level	Low-privileged domain user (`Domain Users`)	Reachable from any domain-joined endpoint
Affected Platforms	Windows Server 2019, Windows Server 2022, Windows Server 2025	Enterprise and Standalone Certification Authorities
Microsoft Patches	Cumulative Updates August 2026 (KB5041578, KB5041585, KB5041592)	Critical Tier-0 patch requirement

2. In-Depth Technical Decomposition & Root Cause

The vulnerability resides within the request dispatch engine of certsrv.exe handling RPC enrollment requests via the ICertRequest2::Submit interface (MS-WCCE). When processing custom X.509 v3 extension attributes (specifically Subject Alternative Name and Authority Information Access), the server parses incoming ASN.1 DER structures into temporary heap objects.

If an enrollment request supplies malformed extension flags accompanied by duplicate OID headers, the parsing routine frees the allocated extension buffer upon encountering an error, but fails to nullify the pointer in the active request structure:

// Conceptual depiction of CVE-2026-62818 Use-After-Free
HRESULT CCertRequest::ParseExtensionDER(
    PBYTE pbExtensionData,
    DWORD cbDataLength,
    PCERT_EXTENSION *ppCertExt
) {
    PCERT_EXTENSION pExt = (PCERT_EXTENSION)HeapAlloc(GetProcessHeap(), 0, sizeof(CERT_EXTENSION));

    if (FAILED(DecodeASN1DER(pbExtensionData, cbDataLength, pExt))) {
        // Buffer freed on decoding failure
        HeapFree(GetProcessHeap(), 0, pExt);
        // VULNERABILITY: Pointer *ppCertExt remains pointing to freed memory!
        // No *ppCertExt = NULL;
        return E_INVALIDARG;
    }
    *ppCertExt = pExt;
    return S_OK;
}

// Subsequent cleanup handler dereferences freed memory
void CCertRequest::CleanupRequest(PREQUEST_CONTEXT pCtx) {
    if (pCtx->pParsedExtension) {
        // Use-After-Free: virtual method invocation on stale memory block!
        pCtx->pParsedExtension->pfnRelease(pCtx->pParsedExtension);
    }
}

By grooming the process heap with controlled memory payloads prior to triggering the cleanup callback, an authenticated attacker hijacks instruction pointer execution within the context of the Certification Authority service process (certsrv.exe).

3. Attack Vectors & Enterprise Threat Scenarios

[ Domain User (Low Privileges) ]
               │
               ▼ (MS-WCCE RPC / TCP 135 & Dynamic Ports)
[ Enterprise Certification Authority (AD CS) ] ── (CVE-2026-62818 Use-After-Free)
               │
               ▼ (SYSTEM Code Execution on CA)
[ Export of CA Private Key (e.g. via Mimikatz / SharpDPAPI) ]
               │
               ▼
[ Forge Arbitrary Certificates: Domain Controller / Domain Admin ]
               │
               ▼ (Kerberos PKINIT / AS-REQ)
[ Full Forest Compromise & Golden Certificate ]

Forensic Correlation with Active Directory Corpus

Kerberos PKINIT & PAC Generation: When an attacker forges an authentication certificate using a stolen CA private key, the KDC issues a valid Kerberos TGT with a privileged PAC. See AD-22: Kerberos PAC structure, validation and forgery.
Authentication vs Authorization in PKI: An authenticated certificate guarantees cryptographic identity, but identity determines domain-wide rights. See AD-05: Authentication vs authorization.
Kerberos Delegations & Impersonation: Forged certificates allow configuring or exploiting Resource-Based Constrained Delegation (RBCD). See AD-25: Kerberos delegations (Unconstrained, Constrained, RBCD).

4. Forensic Detection, Artefacts & Event IDs

DFIR teams investigating potential exploitation of CVE-2026-62818 must inspect Certification Authority operational logs and crash telemetry:

Critical Artefacts & Event IDs

Certification Authority Event ID 4886 (“Certificate Services received a certificate request”): Look for rapid bursts of failed requests containing malformed attributes.
Certification Authority Event ID 4887 (“Certificate Services approved a certificate request and issued a certificate”): Verify if any unexpected certificates for high-privilege accounts (Administrator, DC01$) were issued.
Application Crash Event ID 1000: Application error logs pointing to certsrv.exe crashing in certenc.dll with exception code 0xc0000005 (Access Violation).
Security Event ID 4768: Kerberos TGT requests using Pre-Authentication Type 16 (PKINIT) for privileged accounts from unusual source IPs.

KQL Query: Suspicious PKINIT Authentication Following CA Anomaly

// Detect PKINIT Kerberos authentications following CA request anomalies
SecurityEvent
| where EventID == 4768
| extend PreAuthType = tostring(parse_json(EventData).PreAuthType)
| where PreAuthType == "16" // PKINIT
| where TargetUserName in~ ("Administrator", "krbtgt") or TargetUserName endswith "$"
| project TimeGenerated, TargetUserName, IpAddress, PreAuthType, TicketOptions
| order by TimeGenerated desc

5. Remediation, Hardening & Defensive Engineering

Patch Deployment: Apply Microsoft Cumulative Update August 2026 on all Certification Authorities.
Tier-0 PKI Isolation: Treat all AD CS servers as Tier-0 assets. Ensure CA servers are not accessible from standard workstations.
Audit Certificate Templates: Enforce strict issuance requirements (e.g., CA certificate manager approval) on templates with Client Authentication.
Monitor CA Key Exports: Enable auditing for private key access and export operations in local security policies.