Loading story…
Researchers and defenders warned that Active Directory Certificate Services (AD CS) can be abused to take over Windows domains through a combination of certificate misconfigurations and NTLM relay paths. SpecterOps documented multiple escalation techniques in its Certified Pre-Owned research, including vulnerable certificate templates, arbitrary Subject Alternative Name abuse, weak access controls, and relay attacks against AD CS web enrollment endpoints. The findings showed that attackers can obtain certificates usable for PKINIT or Schannel authentication, enabling privilege escalation, persistence that survives password resets, and in some cases creation of forged "golden certificates" if a CA private key is stolen.
The risk became more urgent as the PetitPotam attack chain demonstrated how coercing NTLM authentication from a domain controller and relaying it to AD CS could lead to complete domain compromise. SANS highlighted the issue as a path to domain admin, while Microsoft published advisory ADV210003 with mitigations rather than a security patch, recommending steps such as enabling Extended Protection for Authentication, requiring HTTPS on certificate enrollment endpoints, and reducing or disabling NTLM where possible. The combined disclosures showed that widely deployed AD CS environments could become a direct route to full Active Directory takeover if left misconfigured.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Rapid7 published analysis showing that the PetitPotam coercion technique could be chained with vulnerable AD CS configurations to fully compromise Windows domains running AD CS. The post connected the PetitPotam attack to the earlier AD CS NTLM relay research and explained how the combination enabled full domain takeover.
SANS Internet Storm Center published analysis describing an Active Directory Certificate Services public key infrastructure weakness that could lead to domain administrator compromise. The write-up amplified the practical security impact of the previously disclosed AD CS abuse techniques.
Microsoft published advisory ADV210003 covering mitigations for NTLM relay attacks against Active Directory Certificate Services. The guidance emphasized defensive configuration changes such as enabling protections around AD CS rather than shipping a direct security patch.
SpecterOps published research detailing multiple Active Directory Certificate Services misconfigurations and attack paths, including ESC1 through ESC8 and NTLM relay to AD CS web enrollment endpoints that could enable privilege escalation, persistence, and domain compromise. The researchers also released the PSPKIAudit defensive auditing tool and said Microsoft had recommended configuration-based mitigations rather than a security update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
rapid7.com
Open sourceisc.sans.edu
Open sourcemsrc.microsoft.com
Open sourcespecterops.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate Windows authentication weaknesses were highlighted as enabling high-impact **Active Directory** compromise via relay-style attacks. One issue, **CVE-2025-33073**, affects Windows **SMB client** authentication and enables **NTLM reflection**: attackers can coerce `lsass.exe` (running as **SYSTEM**) to authenticate to attacker-controlled infrastructure using techniques such as *PetitPotam*, *DFSCoerce*, and *Printerbug*, then relay/reflect that authentication to gain SYSTEM-level access and potentially full domain compromise. Reporting emphasized that despite a June 2025 patch, the condition remains widely present in enterprise environments due to incomplete patch adoption, and exploitation can be enabled with relatively low prerequisites such as the ability to register a malicious AD DNS record (often permitted to Authenticated Users by default) or to perform local DNS poisoning. A second technique described a **Kerberos relay** vector that abuses how Windows clients process **DNS CNAME** responses when building the SPN for TGS requests, allowing an on-path attacker (e.g., via ARP poisoning or DHCPv6/mitm6) to redirect victims to attacker-controlled services and obtain service tickets usable for relays and lateral movement. The write-up claims default configurations across Windows 10/11 and Windows Server 2022/2025 are susceptible, with potential impact including cross-protocol relays (e.g., HTTP→SMB/LDAP) and paths to RCE in some environments (e.g., via ADCS web enrollment scenarios). A separate Metasploit weekly wrap-up noted new and updated offensive modules (including AD privilege-escalation content), but it did not specifically tie to either of the two relay issues above.
Jun 30, 2026
Microsoft disclosed multiple **privilege escalation** vulnerabilities in core enterprise products, including **Active Directory Domain Services** and **SQL Server**, with public reporting highlighting network-reachable attack paths that require only authenticated or otherwise authorized access. **CVE-2026-25177** affects AD DS and was described as an elevation-of-privilege issue tied to improper restriction of file and resource names, enabling abuse of crafted Unicode characters to create duplicate `SPN` or `UPN` values. Reporting indicates this can interfere with Kerberos ticket handling, potentially causing denial of service, triggering fallback to **NTLM** where enabled, and ultimately enabling escalation to **SYSTEM**-level control in affected environments. Microsoft also disclosed **CVE-2026-21262** in **SQL Server**, an **Important**-rated flaw with a **CVSS 8.8** score that allows an authenticated attacker to elevate privileges to `sysadmin`, giving full control over the database instance. Public reporting said Microsoft assessed exploitation as **less likely** and had not observed active in-the-wild abuse at disclosure time, but noted the issue was publicly disclosed, increasing the risk of follow-on exploit development. Other referenced items about **ADCS ESC1**, **Cisco SD-WAN Manager**, and **n8n** concern separate products and unrelated vulnerabilities, while the standalone MSRC entry does not provide enough detail in the supplied content to confirm it is part of the same specific event.
Jun 29, 2026
Two separate local privilege-escalation issues were disclosed in widely deployed Windows remote-access clients. WatchGuard published an advisory for **NCP IPSec VPN Client** as shipped with *WatchGuard Mobile VPN with IPSec* for Windows, where installation/update/uninstall actions can briefly open interactive `cmd.exe` windows running as **SYSTEM**; on older Windows versions, an attacker with local access can execute commands in that prompt to gain **SYSTEM** privileges and bypass administrative protections. WatchGuard states the issue affects versions up to **15.19** and is fixed in **15.33** (advisory **WGSA-2026-00002**, tracked as **NCPVE-2025-0626**). Separately, reporting described a privilege-escalation weakness in **Check Point Harmony SASE (Perimeter81) Windows client** tracked as **CVE-2025-9142**, affecting versions **below 12.2**. The issue is attributed to insufficient validation of **JWT** values passed via a URI handler (`perimeter81://`) to a SYSTEM-privileged service component (`Perimeter81.Service.exe`), enabling directory traversal (e.g., `../../../`) and file write/delete outside the intended certificate working directory; the described attack chain includes crafting a malicious URL, abusing a whitelisted auth domain, and using symlink/object-manager tricks to redirect certificate writes performed with SYSTEM privileges, potentially leading to full local compromise.
Jun 29, 2026