CVE-2026-62818 – Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability

CVE-2026-62818 is a critical use-after-free vulnerability in Windows Active Directory Certificate Services (AD CS). An authenticated attacker with low privileges can send a specially crafted request to an affected service over the network and potentially execute code on the target system. Exploitation requires no user interaction and could have a high impact on confidentiality, integrity, and availability.

CVSS Score: 8.8.

SEVERITY: Critical.

THREAT:
The vulnerability presents a remote code execution threat to affected Windows systems running the vulnerable AD CS functionality. Attack complexity is low, and exploitation can occur over the network. An attacker must have authenticated low-privilege access, but no interaction from another user is required.

EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, and exploitation is assessed as less likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY:
CVE-2026-62818 is caused by a use-after-free condition (CWE-416) in Active Directory Certificate Services. An authenticated attacker can send a specially crafted request to an affected service over the network. Successful exploitation could allow code execution on the target system. The vulnerability has low attack complexity, requires low privileges, requires no user interaction, and has an unchanged scope. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected software includes Windows 10 versions 1607 and 1809, Windows Server 2012 and 2012 R2, Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations. An authenticated attacker with low privileges can exploit the vulnerability by sending a specially crafted network request to an affected service.

BUSINESS IMPACT:
Successful exploitation could allow an attacker to execute code on an affected system, potentially compromising sensitive information, modifying data, or disrupting system availability. For organizations operating AD CS on affected Windows infrastructure, compromise of a critical service could create significant operational and security consequences.

WORKAROUND:
No workaround or mitigation is specified. An official fix is available, making deployment of the applicable security update the documented remediation.

URGENCY:
This vulnerability is rated Critical and enables remote code execution with low attack complexity and no user interaction. Although exploitation is currently assessed as less likely and no active exploitation is identified, affected systems should be prioritized for patching because successful exploitation could have a high impact on confidentiality, integrity, and availability.