Affected Systems
Microsoft Active Directory Certificate Services (AD CS) in Enterprise CA configurations. All versions prior to July 14, 2026 patch. Affects organizations with default AD settings including MachineAccountQuota allowing machine account creation by standard users.
Exploitation Status
Public proof-of-concept published July 24, 2026. No confirmed exploitation in the wild as of disclosure. PoC demonstrates full attack chain from standard domain user to domain admin via forged DC certificate and DCSync.
Business Impact
Complete domain compromise from standard user account. Attacker exploits AD CS "chase" functionality to obtain fraudulent Domain Controller certificate, then uses PKINIT/Kerberos to extract krbtgt hash via DCSync, enabling Golden Ticket attacks. CVSS 8.8. Microsoft patched July 14, 2026. Attack leverages default AD configuration (MachineAccountQuota) and implicit trust between CA and domain—no ACL modification required. Gap between public PoC and weaponization in commodity tools typically measured in weeks.
Urgency
🔴 Immediate
Recommended Actions
- Apply Microsoft security update released July 14, 2026 to all Enterprise Certificate Authority servers immediately
- Set MachineAccountQuota to 0 in Active Directory to prevent standard users from creating machine accounts (default allows 10 per user)
- Audit AD CS certificate template permissions for overly permissive enrollment rights; restrict templates that allow machine or DC authentication to privileged accounts only
- Enable enhanced logging for AD CS enrollment events (Event IDs 4886, 4887, 4888) and monitor for unusual certificate issuance patterns, especially DC machine certificates requested by non-admin accounts
- Treat Enterprise CA as Tier 0 asset: isolate on dedicated network segment, restrict administrative access, and implement privileged access management controls equivalent to Domain Controllers