AD CS Domain Admin climb gets a public PoC, patch April 2025 updates

• Affected: Windows Server 2008 SP2 through Windows Server 2025 with Active Directory Certificate Services, below the April 2025 fixed builds.
• Fixed in: April 2025 Patch Tuesday updates (for example KB5055523 on Server 2025, build 10.0.26100.3775).
• Exploited? No. Not in CISA KEV (checked 27 October 2026). Microsoft reports no exploitation.
• Do this now: confirm every CA host has the April 2025 (or later) cumulative update, then audit strong certificate mappings.

What happened

An authenticated user who can reach Active Directory Certificate Services can elevate privileges over the network. Microsoft's FAQ says that path can reach domain administrator rights.

Microsoft disclosed CVE-2025-27740 on 8 April 2025 as part of the April 2025 Patch Tuesday release. This article covers it more than eighteen months later, after a public proof of concept appeared on 27 October 2026.

Microsoft files the weakness as CWE-1390, Weak Authentication. It scores the flaw CVSS 3.1 8.8 (Important). MSRC marks exploitability as Exploitation Less Likely.

Who is affected

The risk sits on Windows Server hosts that run Active Directory Certificate Services and still lack the April 2025 updates. MSRC lists Server 2008 SP2 through Server 2025, including Server Core where noted.

Am I affected? Check three things. Do you run AD CS on Windows Server? Is the CA host below the fixed build for its release? Can low-privilege users enroll templates that allow authentication? If the answers are yes, yes and yes, treat the host as exposed until patched.

Servers without AD CS installed are outside this CVE's product focus.

What is confirmed

MSRC, NVD, CVE.org and GHSA-w4rq-mvcf-xc7h agree on the product, the CWE and the CVSS 3.1 score of 8.8. Microsoft published the advisory on 8 April 2025 and refreshed FAQ text on 10 April 2025.

Microsoft states Customer Action Required. The FAQ describes an authenticated user who changes attributes on computer accounts they own or manage, then obtains an AD CS certificate that elevates to domain administrator.

CISA's Known Exploited Vulnerabilities catalog does not list CVE-2025-27740 (checked 27 October 2026 against the live KEV JSON feed). Microsoft's advisory still shows exploited as No.

A GitHub repository named for this CVE was created on 27 October 2026. We reviewed the README and Python source without executing anything. The repo cites the same CVE id, CVSS 8.8, and Server 2025 fixed build 26100.3775. It describes Subject Key Identifier handling during enrollment and builds on Certipy request flows. We treat it as a real public PoC for this CVE.

What is not confirmed

Neither Microsoft nor CISA reports real-world exploitation. We found no Certipy release that ships a dedicated module named for this CVE. The PoC wraps Certipy rather than replacing it.

We did not run the PoC. We cannot independently prove every claimed lab result in its README. Account age on GitHub is older than the repo; the repository itself is new and has minimal community review.

No ThreatWire article yet covers classic AD CS ESC paths or Certifried. This page is our first dedicated AD CS write-up.

What to do

1. Inventory every host with the Certification Authority role, including Server Core.
2. Install the April 2025 cumulative update or any later monthly update that supersedes it.
3. Reboot CA hosts if the update requires it, then verify the fixed build number.
4. Audit altSecurityIdentities and other strong certificate mappings on privileged accounts.
5. Review enrollment rights on authentication-capable templates. Remove unused templates.
6. Monitor CA logs for unexpected enrollment by low-privilege principals after patching.
7. Prioritize internet-reachable or tier-0 adjacent CAs if any remain unpatched.

If you cannot patch immediately, reduce who can enroll authentication templates and tighten mapping controls. That is a stopgap, not a substitute for the update.

Our take

AD CS sits next to Kerberos as a second identity plane. When enrollment trusts enrollee-controlled fields too far, a routine user becomes a path to Domain Admin. That is why April 2025's fix still matters in late 2026.

A public PoC does not equal mass exploitation. It does raise the cost of leaving old CA builds online. Pair the patch with mapping and template hygiene, the same discipline defenders already use against ESC-style misconfigurations.

For other recent Microsoft privilege issues on ThreatWire, see the Windows 11 Health Service elevation fix and the .NET October re-fixes.