CVE-2026-62818

Active Directory Certificate Services is the Windows system that issues and manages digital certificates (the “ID cards” used for secure connections). This vulnerability is like a crack in the certificate service’s internal handling that can be triggered by a valid (low-level) account to run attacker code on the server, potentially leading to full control or disruption.

This matters if you run Windows Active Directory Certificate Services (AD CS) on the listed Windows versions (windows 10 and the supported Windows Server releases). Because it requires an authorized account, the risk is highest if an attacker can obtain any valid credentials for an account on the affected system (for example, stolen or weak credentials). Reachability matters: if the AD CS role is installed and the attacker can access/trigger the network-facing certificate services, then it becomes a concern.

This is RED because the vulnerability can be used to execute unauthorized code on a certificate server over the network, using only low-privileged authorized access. Security researchers have linked activity consistent with the Lazarus group to the issue’s patch cycle, so waiting increases the chance attackers will target exposed environments.