Start with Identity
Subscribe
Identity CVE · Kerberos / Active Directory

CVE-2024-49019ESC15 / EKUwu, AD CS V1 template Application Policy precedence

high
Product: Active Directory Certificate ServicesVendor: MicrosoftDisclosed: 2024-11-12Status: PatchedNVD ↗

What broke

AD CS version-1 templates treated Application Policy as trumping Enhanced Key Usage. An operator who thought a template could only issue client-auth certs could be issued a cert with extra EKUs. SpecterOps and the Certipy community track this as ESC15 / "EKUwu." Microsoft patched in November 2024. Plenty of forests still have the old templates.

Why it matters

Most AD CS "CVEs" are misconfigurations (ESC1-ESC16). ESC15 is one of the ones that got a CVE because the product, not just the customer, got the precedence wrong. A cert with the wrong EKU is a smart-card logon, a server auth, or an enrollment-agent grant you never meant to issue. Pair with CVE-2025-26647 (PKINIT / NTAuth) and Certifried.

What to do

  • Patch certificate authorities and then re-issue templates that still behave like V1.
  • Enumerate templates with Certipy or Locksmith. ESC1-ESC16 are still the more common finding.
  • Turn on strong certificate mapping. A wrong EKU plus a weak mapping is a domain logon.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.