PT-2024-8108 · Microsoft · Active Directory Certificate Services+1

Justin Bollinger + 2 · Published 2024-10-12 · Updated 2025-12-23 · CVE-2024-49019

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Active Directory Certificate Services (affected versions not specified)

Description An elevation-of-privilege issue exists in Microsoft Active Directory Certificate Services. Exploitation of this issue may allow an attacker to elevate their privileges within a system. The issue is related to flaws in the authentication procedure and specifically impacts certificate templates with broad permissions. This vulnerability, also known as EKUwu or ESC15, has been actively exploited. While the exact number of affected devices is not specified, the vulnerability poses a risk to domain control. The issue involves the use of version 1 certificate templates.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-1390

Related Identifiers

BDU:2024-09630

CVE-2024-49019

Affected Products

Active Directory Certificate Services

Windows

References · 41

• https://osv.dev/vulnerability/CVE-2024-49019 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09630 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49019 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49019 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49019 · Security Note
• https://twitter.com/Bandrel/status/1845253084064157803 · Twitter Post
• https://twitter.com/testalways/status/1862500776699941353 · Twitter Post
• https://twitter.com/shijith_binoy/status/1862842680776028240 · Twitter Post
• https://twitter.com/uwu_underground/status/1890776650247209404 · Twitter Post
• https://twitter.com/PKISolutions/status/1857151218251915354 · Twitter Post
• https://t.me/kasperskyb2b/1499 · Note
• https://t.me/zerodayalert/380 · Telegram Post
• https://twitter.com/Cthulhu_Answers/status/1982520921207587105 · Twitter Post
• https://twitter.com/NoSpy_ch/status/1862576463368827296 · Twitter Post