An unauthenticated crafted packet becomes code execution in AD DS. Microsoft's record carries CVSS 8.1 with high attack complexity and no observed exploitation.

Microsoft April 2026 Patch Tuesday fixed 163 CVEs, marking its second-largest security update. Three zero-day vulnerabilities impacted SharePoint, Chromium-based Edge workflows and Microsoft Defender.

CVE-2026-54121 lets a standard domain user turn your Enterprise CA into a Domain Controller. The patch is the easy part. The lesson is standing privilege, implicit trust, and treating PKI as the Tier ...

A proof-of-concept exploit for “Certighost,” a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows ...