CVE-2026-69624

Medium6.5 Published on Sep 8, 2026

Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network.

CVSS score6.5 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness type (CWE)CWE-184

Vendorsmicrosoft

Affected products

Vendors	Product	Versions
microsoft	windows 10 1607	< 10.0.14393.9512
microsoft	windows 10 1809	< 10.0.17763.9245
microsoft	windows server 2012	-
microsoft	windows server 2016	< 10.0.14393.9512
microsoft	windows server 2019	< 10.0.17763.9245
microsoft	windows server 2022	< 10.0.20348.5622
microsoft	windows server 2025	< 10.0.26100.33438

Vulnerabilities

Microsoft Patches 966 Flaws as Two Windows Zero-Days Come Under Active Attack

Microsoft fixed 966 flaws in record September Patch Tuesday, including two exploited Windows privilege-escalation zero-days leading to SYSTEM access.

Sep 8, 202621:34 6 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Microsoft Patches 966 Flaws as Two Windows Zero-Days Come Under Active Attack