Skip to content
THREATWIRE
HighPoC Available

CVE-2025-27740

Active Directory Certificate Services weak authentication elevates privileges

An authorized network attacker can elevate privileges through Windows Active Directory Certificate Services. Microsoft fixed it in the April 2025 Patch Tuesday updates. A public PoC appeared on 27 October 2026. Not in CISA KEV.

By ThreatWire Desk · Published 8 Apr 2025 · Updated 27 Oct 2026

CVSS
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Class
Auth bypass
Status
PoC Available
KEV
Not in CISA KEV
0-day
No
Vendor
Microsoft
Products
Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, Windows Server 2025
Affected
Windows Server builds below the April 2025 fixed builds when Active Directory Certificate Services is installed (including Server Core where listed by MSRC).
Fixed
April 2025 Patch Tuesday updates, including KB5055523 (Server 2025, 10.0.26100.3775), KB5055526 (Server 2022), KB5055519 (Server 2019), KB5055521 (Server 2016), and matching rollups for older Server releases.
CWE
CWE-1390
Published
8 Apr 2025
Updated
27 Oct 2026

The status above is the claim. Links do not upgrade it.

CVE-2025-27740 is weak authentication in Windows Active Directory Certificate Services. An authorized attacker can elevate privileges over a network.

Affected: Windows Server 2008 SP2 through Windows Server 2025 with AD CS, below the April 2025 fixed builds. Fixed by: the April 2025 Patch Tuesday updates (for example KB5055523 on Server 2025).

Microsoft scores it CVSS 3.1 8.8 (Important). The weakness is CWE-1390, Weak Authentication. MSRC rates exploitability as Exploitation Less Likely and, as of its advisory, reports no exploitation.

Microsoft's FAQ says an authenticated user can manipulate attributes on computer accounts they own or manage, then get a certificate from AD CS that elevates to domain administrator rights.

A public proof-of-concept repository matching this CVE was published on 27 October 2026. We read it without running it. It targets the same CVE id and the April 2025 builds. CISA KEV does not list the CVE (checked 27 October 2026).

Read the full explainer: AD CS Domain Admin climb public PoC.

Sources

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/cve/cve-2025-27740