Certificate validation vulnerability in Windows Active Directory Certificate Services (CVE-2026-105590)

What happened

NVD reports CVE-2026-105590, an improper certificate validation flaw in Windows Active Directory Certificate Services (AD CS). The flaw can allow an authorised attacker to bypass a security feature over a network. Exploitation requires a low-privileged account and no user interaction; the affected service must be reachable over the network. The weakness is classified as CWE-295. The vulnerability is rated medium, with an NVD score of 5.3. The stated CVSS impact is high for integrity, with no impact stated for confidentiality or availability. NVD analysis remains in progress, so the scope may change. A fix is available.

Who is affected

Affected deployments are systems running the AD CS role on the following Windows Server versions and builds:

Windows Server 2016 and Server Core: <code>10.0.14393.0</code> to before <code>10.0.14393.9688</code>. Windows Server 2019 and Server Core: <code>10.0.17763.0</code> to before <code>10.0.17763.9487</code>. Windows Server 2022: <code>10.0.20348.0</code> to before <code>10.0.20348.5870</code>. Windows Server 2025: <code>10.0.26100.0</code> to before <code>10.0.26100.33822</code>.

The supplied affected-version information does not list a Server Core installation for Windows Server 2025. Fixed-version details are not available in the supplied information.

Recommended actions

1. <strong>Restrict</strong> network exposure of the AD CS service to reduce direct access by potential attackers.
2. <strong>Segment</strong> networks so that access to exposed AD CS services is limited to necessary, trusted network paths.
3. <strong>Review</strong> access controls in front of the service, ensuring access is limited to accounts and systems that require it.
4. <strong>Apply</strong> the available fix to affected deployments, following vendor guidance. Check the vendor advisory for fixed-version details, which are not provided here.