CVE-2026-69624

Awaiting Analysis Awaiting Analysis - Queue

Active Directory Certificate Services Tampering Vulnerability

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Microsoft Corporation

Description

Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-69624

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	active_directory_certificate_services	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This vulnerability in Active Directory Certificate Services (AD CS) occurs because the system does not properly block all malicious inputs. An authorized attacker can exploit this to tamper with data over a network.

Impact Analysis

An attacker could modify critical data in AD CS, potentially leading to unauthorized access, data integrity issues, or further network compromise. This requires the attacker to already have authorized access.

Compliance Impact

This vulnerability could violate compliance requirements that mandate data integrity and protection, such as GDPR's integrity principle or HIPAA's security rule, due to the risk of unauthorized data tampering.

Mitigation Strategies

Apply Microsoft's security updates for Active Directory Certificate Services to address the incomplete input validation issue. Review and restrict unauthorized user permissions in AD CS to limit tampering risks.

Hi! I’m here to help you understand CVE-2026-69624. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70