CVE-2024-49019ESC15 / EKUwu, AD CS V1 template Application Policy precedence
What broke
AD CS version-1 templates treated Application Policy as trumping Enhanced Key Usage. An operator who thought a template could only issue client-auth certs could be issued a cert with extra EKUs. SpecterOps and the Certipy community track this as ESC15 / "EKUwu." Microsoft patched in November 2024. Plenty of forests still have the old templates.
Why it matters
Most AD CS "CVEs" are misconfigurations (ESC1-ESC16). ESC15 is one of the ones that got a CVE because the product, not just the customer, got the precedence wrong. A cert with the wrong EKU is a smart-card logon, a server auth, or an enrollment-agent grant you never meant to issue. Pair with CVE-2025-26647 (PKINIT / NTAuth) and Certifried.
What to do
- Patch certificate authorities and then re-issue templates that still behave like V1.
- Enumerate templates with Certipy or Locksmith. ESC1-ESC16 are still the more common finding.
- Turn on strong certificate mapping. A wrong EKU plus a weak mapping is a domain logon.
After you patch
Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.
- Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
- Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
- Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.
Sources
- NVD: CVE-2024-49019
- SpecterOps / Certipy ESC15 notes
Related identity CVEs
Related on Start with Identity
- GlossaryActive Directory
Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a
- RankingBest ITDR for Active Directory: Top 5 AD Security Platforms
The best ITDR platforms for Active Directory in 2026: Semperis, Microsoft Defender for Identity, Silverfort, Cayosoft, and Quest Change Auditor. Ranked for AD t
- ExpertEntra ID and Active Directory researcher
Dirk-jan Mollema researches Microsoft identity from the outside and writes the tooling to prove his findings: ROADtools for Entra ID, mitm6 and krbrelayx for re
- GuideIAM Cloud Migration Guide: From On-Prem Active Directory to Cloud Identity
A practical guide to migrating from on-premises Active Directory to cloud IAM, covering hybrid identity architecture, migration phases, coexistence strategies,
- ArticleTop 5 Directory Services Solutions in 2026
Compare the top 5 directory services solutions in 2026, from Microsoft Active Directory and JumpCloud to OpenLDAP, for managing identities across your infrastru
- ArticleTop 6 Open-Source Directory Services and LDAP Servers
The best open-source directory servers in 2026, from OpenLDAP and 389 Directory Server to FreeIPA, Samba AD, Kanidm, and LLDAP, compared on protocol support, Ac
Technique
This CVE is an instance of AD CS certificate template abuse. A certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.