The vulnerability arises from an incomplete list of disallowed inputs in Active Directory Certificate Services, which permits an attacker with authorized privileges to tamper with the service over the network. This flaw enables an attacker to alter or inject certificates or certificate templates, potentially compromising cryptographic operations, authentication, and authorization within the domain. The weakness corresponds to improper input validation, identified as CWE-184, and has the capacity to affect the integrity of the certificate infrastructure.

Microsoft products affected include Windows 10 versions 1607 and 1809, and Windows Server from 2012 through 2025, including all core and non‑core installations. The affected components are specifically the Active Directory Certificate Services (AD CS) on these operating systems.

The CVSS score of 6.5 indicates a moderate severity. An authorized attacker within the network can exploit the lack of input validation to tamper with AD CS data, but the vulnerability requires existing elevated privileges or trusted network access. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, suggesting that while exploitation is feasible, it may not be widespread yet. The likely attack vector is internal network traffic targeting AD CS endpoints with sufficient privileges.