A race condition in Active Directory Certificate Services allows an attacker with authorized access to perform simultaneous operations on a shared resource that is not properly synchronized. The flaw can be exploited to elevate local privileges, enabling the attacker to acquire higher privileges on the target system. The vulnerability is categorized under CWE‑362, which indicates a concurrency issue that may lead to privilege escalation or unauthorized access.

The flaw affects Microsoft Windows 10 version 1607 and 1809, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations. Any deployment of Active Directory Certificate Services on these operating systems is potentially impacted unless patched to a fixed build.

With a CVSS score of 7, the issue is considered high severity. The EPSS score is not available, indicating limited publicly observed exploitation data. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation yet. The likely attack vector is a local attacker with legitimate credentials who can trigger the race condition through controlled timing of service requests. Because the flaw requires concurrency on a shared resource, successful exploitation depends on the attacker’s ability to orchestrate simultaneous requests, making arbitrary remote exploitation unlikely but still significant for insiders or compromised accounts.