IT SBIT Services
Schneeberger
DEEN
CVE tracker

Active Directory Certificate Services: Local privilege escalation via race condition

CVE-2026-83666High 7.0

← All vulnerabilities

Summary

A race condition (CWE-362) in Active Directory Certificate Services (AD CS) allows an authorized local user to elevate privileges. The CVSS 3.1 base score is 7 (High), with high impact on confidentiality, integrity and availability. Exploitation requires local access, high attack complexity and low privileges, so an attacker must already have a foothold on the affected system.

Affected

  • Windows 10 Version 1607 and 1809 (versions below 10.0.14393.9612 and 10.0.17763.9376)
  • Windows Server 2012 and 2012 R2, including Server Core (versions below 6.2.9200.26434 and 6.3.9600.23470)
  • Windows Server 2016 and 2019, including Server Core (versions below 10.0.14393.9612 and 10.0.17763.9376)
  • Windows Server 2022 (versions below 10.0.20348.5761)
  • Windows Server 2025, including Server Core (versions below 10.0.26100.33650)

Fixed in

  • Windows 10 1607 / Server 2016: 10.0.14393.9612
  • Windows 10 1809 / Server 2019: 10.0.17763.9376 (a third-party source lists KB5126651; verify with MSRC)
  • Windows Server 2012 / 2012 R2: 6.2.9200.26434 / 6.3.9600.23470 (only a third-party aggregator; verify with MSRC)
  • Windows Server 2022: 10.0.20348.5761
  • Windows Server 2025: 10.0.26100.33650
  • KB numbers for 1607 / Server 2016: Unknown.

Workaround

Unknown. No CVE-specific workaround was found. Install the security update as the primary remediation.

Exploitation

  • No evidence of exploitation in the wild found; not listed in CISA KEV.
  • No public proof-of-concept found.
  • CISA SSVC: exploitation none, automatable no, technical impact total.
  • EPSS is about 0.002 (low predicted exploitation probability).

Our recommendation

  • Patch all AD CS servers (Windows Server 2012 through 2025) first, using the fixed builds above and the MSRC advisory to confirm KB numbers.
  • Check whether any Windows 10 1607 systems hold the AD CS role, and upgrade or patch them.
  • Limit local logon on certification authority hosts and remove unneeded local accounts.
  • Restrict AD CS enrollment rights to what is necessary.
  • Monitor CA hosts for unusual local privilege changes.
  • Priority: medium-high for organizations running AD CS; low elsewhere.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Active Directory Certificate Services (AD CS)
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation unlikely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126651, KB5126655, KB5126646, KB5126868, KB5126835, KB5126836

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:38.

Original description (NVD)

Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed