Microsoft Fixes AD CS Flaw Allowing Local SYSTEM Privilege Escalation

Microsoft released a security update for CVE-2026-69821, an important elevation-of-privilege vulnerability in Active Directory Certificate Services (AD CS). A locally authenticated attacker with low privileges could exploit the flaw to obtain SYSTEM privileges without user interaction, potentially gaining complete control of an affected Windows host.

The vulnerability is associated with CWE-116, improper encoding or escaping of output, and carries a CVSS v3.1 base score of 7.8. Microsoft reported that a fix is available and, at disclosure, had found no public disclosure or evidence of exploitation in the wild; it assessed exploitation as less likely.