CVE-2026-69624

Published: Sep 8, 2026Modified: Sep 24, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: secure@microsoft.com (Secondary)

Description

Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network.

Affected (10)

Products: Microsoft: Windows 10 1607, Windows 10 1809, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025

7 products

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 10 1607	version < 10.0.14393.9512
Microsoft Windows 10 1607	version < 10.0.14393.9512
Microsoft Windows 10 1809	version < 10.0.17763.9245
Microsoft Windows 10 1809	version < 10.0.17763.9245
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2
Microsoft Windows Server 2016	version < 10.0.14393.9512
Microsoft Windows Server 2019	version < 10.0.17763.9245
Microsoft Windows Server 2022	version < 10.0.20348.5622
Microsoft Windows Server 2025	version < 10.0.26100.33438

Related CWEs

CWE-184

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69624

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.