CVE-2024-49019ESC15 / EKUwu, AD CS V1 template Application Policy precedence
What broke
AD CS version-1 templates treated Application Policy as trumping Enhanced Key Usage. An operator who thought a template could only issue client-auth certs could be issued a cert with extra EKUs. SpecterOps and the Certipy community track this as ESC15 / "EKUwu." Microsoft patched in November 2024. Plenty of forests still have the old templates.
Why it matters
Most AD CS "CVEs" are misconfigurations (ESC1-ESC16). ESC15 is one of the ones that got a CVE because the product, not just the customer, got the precedence wrong. A cert with the wrong EKU is a smart-card logon, a server auth, or an enrollment-agent grant you never meant to issue. Pair with CVE-2025-26647 (PKINIT / NTAuth) and Certifried.
What to do
- Patch certificate authorities and then re-issue templates that still behave like V1.
- Enumerate templates with Certipy or Locksmith. ESC1-ESC16 are still the more common finding.
- Turn on strong certificate mapping. A wrong EKU plus a weak mapping is a domain logon.
After you patch
Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.
- Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
- Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
- Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.
Sources
- NVD: CVE-2024-49019
- SpecterOps / Certipy ESC15 notes
Related identity CVEs
Related on Start with Identity
- RankingBest ITDR for Active Directory: Top 5 AD Security Platforms
The best ITDR platforms for Active Directory in 2026: Semperis, Microsoft Defender for Identity, Silverfort, Cayosoft, and Quest Change Auditor. Ranked for AD t
- GuideIAM Cloud Migration Guide: From On-Prem Active Directory to Cloud Identity
A practical guide to migrating from on-premises Active Directory to cloud IAM, covering hybrid identity architecture, migration phases, coexistence strategies,
- ArticleTop 5 Directory Services Solutions in 2026
Compare the top 5 directory services solutions in 2026, from Microsoft Active Directory and JumpCloud to OpenLDAP, for managing identities across your infrastru
- ArticleTop 6 Open-Source Directory Services and LDAP Servers
The best open-source directory servers in 2026, from OpenLDAP and 389 Directory Server to FreeIPA, Samba AD, Kanidm, and LLDAP, compared on protocol support, Ac
- ArticleTop 7 Open-Source Active Directory Security Tools
The best open-source and free Active Directory security tools in 2026, from BloodHound Community Edition and PingCastle to Certipy, ADeleg, Impacket, adalanche,
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
Technique
This CVE is an instance of AD CS certificate template abuse. A certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.