CVE-2026-55001

What it actually does

This vulnerability is a local privilege escalation flaw caused by improper certificate validation in Windows Active Directory components. An attacker who already has an authorized low-privileged account and local access to an affected Windows system may be able to cause Active Directory certificate-based trust decisions to be accepted incorrectly, allowing code or authentication operations to run with elevated privileges. Successful exploitation can compromise confidentiality, integrity, and availability on the affected host, and may provide a stepping stone toward broader domain compromise depending on the role of the system and the privileges obtained.

Why it matters to the business

If exploited, a low-privileged user or attacker who has already gained access to a Windows host could become an administrator on that system. On domain controllers, certificate services hosts, management servers, or other high-value Windows servers, this could lead to credential theft, security control tampering, lateral movement, service disruption, and broader Active Directory compromise. Although there is no known public exploitation or KEV listing in the provided data, the flaw affects multiple widely deployed Windows client and server versions, so remediation should be prioritized for servers and privileged-access workstations.

How an attack unfolds

An attacker first obtains valid low-privileged access to an affected Windows system, such as through stolen credentials, phishing, malware, or misuse of an existing account. Because the vulnerability requires local access and low privileges, the attacker must already be able to execute commands or log on locally to the target. The attacker then triggers the vulnerable Active Directory certificate-validation path using a crafted or otherwise improperly validated certificate-related operation. If the system accepts the certificate validation state incorrectly, the attacker can cause the operation to execute under a more privileged local security context. After privilege escalation, the attacker typically creates persistence, disables or bypasses endpoint controls, dumps credentials, accesses sensitive data, and attempts lateral movement, especially if the compromised host has administrative tooling, cached credentials, or domain-related services.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions: Windows 10 1607, Windows 10 1809, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so administrators should use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, or equivalent patch-management tooling to confirm the applicable cumulative update for each OS version. Prioritize domain controllers, AD CS servers, identity-management servers, administrative jump hosts, and systems used by privileged users. Where immediate patching is not possible, reduce local logon rights, enforce least privilege, restrict interactive access to servers, monitor certificate-based authentication and certificate services activity, and ensure endpoint protection and credential-theft mitigations are enabled.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows host has installed the relevant Microsoft cumulative security update released for this vulnerability or a later superseding update. Validate through centralized patch inventory, Windows Update history, WSUS/SCCM compliance reports, or PowerShell queries such as reviewing installed hotfixes and OS build numbers against Microsoft’s fixed build guidance. Confirm that no unsupported affected Windows versions remain exposed. For high-value hosts, perform a post-patch reboot verification, confirm Active Directory and certificate services remain healthy, and review recent local administrator group membership, privileged logon events, and certificate-related audit logs for suspicious activity before and after remediation.

Typical attack path

1. Gain valid low-privileged access to an affected Windows workstation or server.
2. Establish local command execution on the target system.
3. Identify whether the host is running an affected Windows version and whether Active Directory certificate-related components or domain functionality are present.
4. Trigger the vulnerable certificate-validation behavior using a crafted certificate-related local operation or tool.
5. Obtain elevated local privileges if validation is incorrectly accepted.
6. Use elevated privileges to dump credentials, modify local security settings, install persistence, or disable defenses.
7. Pivot to other systems if privileged credentials, domain administration tools, or sensitive services are accessible from the compromised host.

How to detect it

There are no unique public exploit indicators provided for this vulnerability, so detection should focus on behavioral evidence of local privilege escalation and certificate-related abuse. Review Windows Security logs, System logs, PowerShell logs, Sysmon telemetry, endpoint detection alerts, and Active Directory Certificate Services logs. Look for low-privileged accounts that suddenly perform administrative actions, new or unexpected local administrator membership, abnormal certificate enrollment or certificate-authentication activity, privileged logons shortly after certificate events, attempts to access LSASS, security product tampering, new services or scheduled tasks, and suspicious PowerShell or command-line execution. On domain controllers and certificate services hosts, review certificate request, issuance, template modification, Kerberos authentication, account modification, and directory object change events. Correlate Event ID 4768 certificate-related Kerberos activity, AD CS events, local group membership changes, and process telemetry around the same user and host within a short time window.

• Event ID 4672
• Event ID 4624
• Event ID 4688
• Event ID 4732
• Event ID 4738
• Event ID 7045
• Event ID 4698
• Event ID 4768
• Event ID 4886
• Event ID 4887
• Event ID 4898
• Event ID 5136
• msDS-KeyCredentialLink
• certreq.exe
• certutil.exe
• powershell.exe -EncodedCommand
• Add-LocalGroupMember
• net localgroup administrators
• SeDebugPrivilege
• lsass.exe
• procdump.exe
• comsvcs.dll
• MiniDump

What your security team should do

• Prioritize patching domain controllers, AD CS infrastructure, privileged access workstations, administrative jump servers, and Windows servers hosting identity or management functions.
• Inventory all affected Windows 10 1607, Windows 10 1809, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems and track them to confirmed remediation.
• Hunt for recent low-privileged-to-administrator privilege changes, unusual local administrator group modifications, and suspicious certificate-related authentication or enrollment activity.
• Restrict local interactive logon and remote desktop access to servers to only required administrative groups.
• Review and harden Active Directory certificate services configuration, certificate template permissions, enrollment permissions, and certificate-based authentication logging.
• Increase monitoring of privileged Windows hosts until patching is complete, especially for credential dumping, security tooling tampering, and lateral movement behavior.
• Because no public exploit maturity or KEV status is reported in the provided data, treat this as a high-priority patching issue rather than confirmed active exploitation, unless local telemetry indicates otherwise.