Loading vulnerability…
EKUwu (ESC15)
CVE-2024-49019, also known as EKUwu or ESC15, is an elevation-of-privilege vulnerability in Microsoft Active Directory Certificate Services. Unpatched certificate authority servers allow attackers to inject arbitrary application policies into certificates issued using version 1 certificate templates. Attacker-supplied application policies in certificate signing requests can take precedence over the template's configured Extended Key Usage attributes, enabling issuance of certificates with unintended capabilities and potential escalation to domain administrator.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can grant domain administrator privileges. Attackers with enrollment rights can abuse version 1 templates, including WebServer, to obtain certificates usable for client authentication, certificate request agent operations, or code signing despite the template's intended usage restrictions.
If you can’t patch tonight, do this now.
Review published version 1 certificate templates, particularly those allowing request-supplied subject names and broad Enroll permissions. Restrict enrollment rights to necessary principals and disable unused certificate templates and enrollment interfaces. Monitor certificate signing requests and certificate-related authentication activity. These controls reduce exposure but do not replace patching the certificate authority.
Patch, then assume compromise.
Apply the applicable Microsoft security updates released on November 12, 2024, to affected Windows servers running Active Directory Certificate Services.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.