May 2026 – Secure Active Directory

ESC3 in Active Directory Certificate Services

May 14, 2026

ESC3 is an Active Directory Certificate Services exposure involving certificate templates that issue Certificate Request Agent certificates. These certificates allow an authorized person or service to submit certificate requests on behalf of another user. This capability has legitimate uses. Organizations may use enrollment agents for smart card deployments, identity registration workflows, Windows Hello for Business, […]

ESC3 in Active Directory Certificate Services Read Post »

ESC2 in Active Directory Certificate Services

May 13, 2026

ESC2 is an Active Directory Certificate Services (AD CS) exposure where a certificate template allows certificates to be issued with the Any Purpose Extended Key Usage (EKU), or with no EKU restrictions at all. Unlike certificates that are limited to a specific function, these certificates may be accepted for many different purposes depending on the

ESC2 in Active Directory Certificate Services Read Post »

ESC8 in Active Directory Certificate Services

May 11, 2026

ESC8 is an Active Directory Certificate Services exposure involving HTTP-based certificate enrollment endpoints and NTLM relay. ESC8 exists when an attacker can relay NTLM authentication to an AD CS enrollment endpoint and obtain a certificate that may be useful for authentication. This matters because certificates can act like credentials. If an attacker can obtain a

ESC8 in Active Directory Certificate Services Read Post »

Shadow Credentials in Active Directory

May 4, 2026

Shadow Credentials is a common name for an Active Directory attack path involving unauthorized key credential material on a user or computer object. Shadow Credentials exists when an attacker can add a key credential to an Active Directory object and later use that credential to authenticate as that object. This matters because the attacker may

Shadow Credentials in Active Directory Read Post »