# ESC15 / EKUwu, AD CS V1 template Application Policy precedence

Source: https://startwithidentity.com/cves/cve-2024-49019/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

AD CS version-1 templates treated Application Policy as trumping Enhanced Key Usage. An operator who thought a template could only issue client-auth certs could be issued a cert with extra EKUs. SpecterOps and the Certipy community track this as ESC15 / "EKUwu." Microsoft patched in November 2024. Plenty of forests still have the old templates.

## Why it matters

Most AD CS "CVEs" are misconfigurations (ESC1-ESC16). ESC15 is one of the ones that got a CVE because the product, not just the customer, got the precedence wrong. A cert with the wrong EKU is a smart-card logon, a server auth, or an enrollment-agent grant you never meant to issue. Pair with [CVE-2025-26647](https://startwithidentity.com/cves/cve-2025-26647/) (PKINIT / NTAuth) and [Certifried](https://startwithidentity.com/cves/cve-2022-26923/).

## What to do

- Patch certificate authorities and then re-issue templates that still behave like V1.
- Enumerate templates with Certipy or Locksmith. ESC1-ESC16 are still the more common finding.
- Turn on strong certificate mapping. A wrong EKU plus a weak mapping is a domain logon.

## After you patch

Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.

- **Rotate the krbtgt account twice**, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- **Audit AD CS certificate templates** for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See [certificate lifecycle](https://startwithidentity.com/glossary/certificate-lifecycle/).
- **Review privileged group membership and delegation rights** (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- **Hunt for tickets with anomalous lifetimes or encryption types**, and for authentications to services that identity never touches.
- **Treat any issued certificate as a durable credential**: revoking a user's password does not revoke a certificate that authenticates as them. See [privilege escalation](https://startwithidentity.com/glossary/privilege-escalation/) and [lateral movement](https://startwithidentity.com/glossary/lateral-movement/).

## Sources

- [NVD: CVE-2024-49019](https://nvd.nist.gov/vuln/detail/CVE-2024-49019)
- SpecterOps / Certipy ESC15 notes