Start with Identity

CVE-2024-49019ESC15 / EKUwu, AD CS V1 template Application Policy precedence

high
Product: Active Directory Certificate ServicesVendor: MicrosoftDisclosed: 2024-11-12Status: PatchedNVD ↗

What broke

AD CS version-1 templates treated Application Policy as trumping Enhanced Key Usage. An operator who thought a template could only issue client-auth certs could be issued a cert with extra EKUs. SpecterOps and the Certipy community track this as ESC15 / "EKUwu." Microsoft patched in November 2024. Plenty of forests still have the old templates.

Why it matters

Most AD CS "CVEs" are misconfigurations (ESC1-ESC16). ESC15 is one of the ones that got a CVE because the product, not just the customer, got the precedence wrong. A cert with the wrong EKU is a smart-card logon, a server auth, or an enrollment-agent grant you never meant to issue. Pair with CVE-2025-26647 (PKINIT / NTAuth) and Certifried.

What to do

  • Patch certificate authorities and then re-issue templates that still behave like V1.
  • Enumerate templates with Certipy or Locksmith. ESC1-ESC16 are still the more common finding.
  • Turn on strong certificate mapping. A wrong EKU plus a weak mapping is a domain logon.

After you patch

Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.

  • Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
  • Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
  • Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
  • Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
  • Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.

Sources

Last reviewed By SWI Community TeamSuggest a correctionHow we research

Technique

This CVE is an instance of AD CS certificate template abuse. A certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.

Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.