CVE-2025-54241: Exploiting Windows Active Directory Certificate Services NTLM Relay

In August 2025, Microsoft patched CVE-2025-54241, a privilege escalation vulnerability in Active Directory Certificate Services (AD CS) that enables NTLM relay attacks to compromise domain controllers. The flaw, disclosed via the Microsoft Security Response Center (MSRC) advisory, carries a CVSS score of 8.8 and affects all supported Windows Server versions. This article dissects the technical root cause, the attack chain leveraging the certificate trust list (CTL), and provides actionable detection rules and mitigation steps. After reading, you will understand how to audit your AD CS environment, write Sigma rules to catch relay attempts, and apply the vendor-recommended patches effectively.

Background: The AD CS NTLM Relay Flaw

CVE-2025-54241 is an elevation of privilege vulnerability in Active Directory Certificate Services (AD CS), specifically in the certificate enrollment and renewal process. Microsoft's advisory describes it as an NTLM relay flaw that allows an attacker who already has authenticated access to a domain-joined system to relay NTLM authentication to AD CS and obtain a certificate that can be used for further lateral movement, potentially leading to domain administrator compromise.

The vulnerability was discovered by security researchers who identified a flaw in the way AD CS handles the certificate trust list (CTL) during the certificate request process. An attacker can manipulate the CTL to include a rogue certification authority (CA) certificate, causing the AD CS server to issue a certificate with elevated privileges. This issue is tracked as CVE-2025-54241 and has a CVSS score of 8.8 (High), according to the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-54241.

The root cause lies in the NTLM relay protection mechanisms implemented in AD CS. Microsoft had previously introduced protections against NTLM relay attacks, such as requiring Extended Protection for Authentication (EPA) and enabling the 'EnableUserInteraction' flag. However, CVE-2025-54241 bypasses these protections by exploiting a race condition in the CTL validation. Specifically, the CTL is not properly validated for signature and issuer before being used in certificate enrollment, allowing an attacker to inject a malicious CTL that points to a CA they control.

This vulnerability is particularly dangerous because it can be chained with other NTLM relay techniques, such as those described in public research (e.g., the 'Relaying NTLM to AD CS' attack). It affects all AD CS deployments that have not applied the August 2025 security update.

Affected Versions and Patch Availability

According to the Microsoft advisory for CVE-2025-54241, the vulnerability affects all supported versions of Windows Server, including Windows Server 2016, 2019, 2022, and 2025, when the Active Directory Certificate Services role is installed. The advisory also notes that client versions of Windows are not affected because AD CS is a server role.

Microsoft released a security update as part of the August 2025 Patch Tuesday, which addresses this vulnerability. The update is available through the Microsoft Update Catalog and Windows Update. Administrators should apply the update immediately, especially on domain controllers and CA servers, as these are the primary targets for NTLM relay attacks.

For a complete list of affected versions and the specific KB numbers, refer to the official MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54241. The advisory also includes a workaround for organizations that cannot immediately patch, which involves disabling NTLM authentication on the AD CS server or enabling EPA. However, these workarounds may impact legacy applications and should be tested carefully.

Additionally, CISA has not yet added this CVE to its Known Exploited Vulnerabilities catalog as of the writing of this article, but given the critical nature and the active exploitation of similar AD CS flaws, it is advisable to treat this as a high-priority patch.

Attacker TTPs: Exploiting the CTL Flaw

Attackers exploit CVE-2025-54241 by leveraging a chain of techniques to relay NTLM authentication and obtain a certificate. The following MITRE ATT&CK techniques are relevant:

• T1557.001 (Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay) — Attackers often use tools like Responder to poison name resolution and capture NTLMv2 hashes, which can then be relayed to AD CS.
• T1550.002 (Use Alternate Authentication Material: Pass-the-Hash) — While not directly used, the obtained certificate can be used for pass-the-certificate attacks.
• T1649 (Steal or Forge Authentication Certificates) — The attack results in the theft of a certificate, which is a form of forging authentication material.
• T1190 (Exploit Public-Facing Application) — In some scenarios, if AD CS is exposed via a web enrollment interface, attackers may target it directly.

The attack flow typically proceeds as follows:

1. Initial Access: The attacker gains a foothold on a domain-joined machine, often through phishing or exploiting another vulnerability.
2. NTLM Capture: Using Responder or a similar tool, the attacker poisons LLMNR/NBT-NS to capture NTLMv2 hashes from other systems attempting to resolve non-existent names.
3. Relay to AD CS: Instead of cracking the hash, the attacker relays the captured authentication to the AD CS web enrollment endpoint (e.g., https://caserver/certsrv/certfnsh.asp) or the RPC interface. The relayed authentication is used to request a certificate.
4. CTL Injection: The attacker crafts a malicious certificate request that includes a manipulated CTL. Due to the vulnerability, the AD CS server does not properly validate the CTL and issues a certificate that includes elevated attributes, such as the Client Authentication or Smart Card Logon EKUs, but with a subject that matches a privileged account.
5. Lateral Movement: The attacker uses the obtained certificate to authenticate as the targeted user, potentially gaining domain admin privileges if the user is in a privileged group.

This technique is similar to the well-known ESC1-ESC8 vulnerabilities in AD CS, but CVE-2025-54241 introduces a new vector via the CTL. Defenders should monitor for anomalous certificate enrollment requests, especially those coming from non-CA servers.

Detection: Sigma Rule for CVE-2025-54241

To detect attempts to exploit CVE-2025-54241, security teams can deploy the following Sigma rule, which monitors Windows Security Event Logs for suspicious certificate enrollment activities. The rule looks for event ID 4886 (Certificate Services received a certificate request) and 4887 (Certificate Services approved a certificate request) where the requester is not a known CA or the request contains unusual certificate templates.

title: Suspicious AD CS Certificate Enrollment via NTLM Relay
id: 8f2a6d1e-5c4b-4f3a-9e7d-2b1c8a6f4e3d
status: experimental
description: Detects potential exploitation of CVE-2025-54241 by flagging certificate enrollment requests that originate from non-CA hosts and use sensitive templates.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54241
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54241
author: CybernytronX Research
date: 2025/08/15
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 4886
            - 4887
        RequestType: 'enroll'
    filter_known_ca:
        Requester: 'CA$'
    filter_legit_templates:
        CertificateTemplate:
            - 'User'
            - 'Machine'
    condition: selection and not filter_known_ca and not filter_legit_templates
level: high
falsepositives:
    - Legitimate certificate enrollment from authorized systems using custom templates.
tags:
    - attack.credential_access
    - attack.t1649

Additionally, defenders can create a YARA rule to detect malicious CTL files on disk, though this is less common. The Sigma rule above should be tested in a lab environment and tuned to the organization's baseline.

For network-level detection, Snort or Suricata rules can be written to detect unusual HTTP requests to the AD CS web enrollment endpoint, especially those containing long CTL parameters. Here is an example Suricata rule:

alert http any any -> $HOME_NET 443 (msg:"Potential CVE-2025-54241 AD CS NTLM Relay Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/certsrv/certfnsh.asp"; http_uri; content:"Mode=checkreq"; http_uri; content:"TargetStoreFlags=0"; http_uri; content:"SaveCert=yes"; http_uri; pcre:"/CTL|ctl|PKCS7/i"; sid:20250801; rev:1;)

These rules should be deployed alongside existing detection for NTLM relay tools like Responder, which often generate event ID 4776 (Credential Validation) with anomalous source IPs.

Mitigation: Patching and Configuration Hardening

The primary mitigation for CVE-2025-54241 is to apply the August 2025 security update from Microsoft. The update addresses the CTL validation flaw and should be installed on all AD CS servers. For organizations that cannot immediately patch, Microsoft recommends the following workarounds:

• Enable Extended Protection for Authentication (EPA) on the AD CS server. This can be done by setting the ExtendedProtection registry key to 1 or 2 in HKLM\SYSTEM\CurrentControlSet\Control\Lsa.
• Disable NTLM authentication on the AD CS server via Group Policy (Network security: Restrict NTLM: Incoming NTLM traffic). This may break legacy clients.
• Restrict access to the AD CS web enrollment endpoint using firewall rules or VPN requirements to limit who can reach the enrollment pages.

Additionally, defenders should review their AD CS configuration for known misconfigurations that could exacerbate the impact. For instance, ensuring that certificate templates do not allow low-privileged users to request certificates with elevated EKUs. The following PowerShell command can be used to list templates and their issuance policies:

Get-CATemplate | Select-Object Name, OID, SchemaVersion | Format-Table

Regularly audit certificate templates to remove any that allow SAN (Subject Alternative Name) modification, as this is a common vector for privilege escalation in AD CS attacks.

Finally, enable auditing on the AD CS server to log all certificate requests. This can be done by running the following command:

certutil -setreg CA\AuditFilter 127

This will enable full auditing, which is essential for detecting malicious enrollment attempts.

Why This Matters for Defenders

CVE-2025-54241 represents a critical evolution in AD CS exploitation, as it bypasses previously recommended mitigations like EPA. This vulnerability underscores the importance of treating AD CS as a Tier 0 asset, equivalent to domain controllers, given its ability to issue certificates that grant domain-wide access. Defenders must not only patch but also reassess their AD CS architecture, ensuring that no CA servers are reachable from untrusted networks and that all enrollment requests are monitored.

The attack chain also highlights the continued relevance of NTLM relay attacks, which remain a top vector for lateral movement in Windows environments. Even as organizations move toward Kerberos and certificate-based authentication, legacy protocols like NTLM persist due to compatibility reasons, creating a fertile ground for attackers. This vulnerability should prompt security teams to accelerate their efforts to eliminate NTLM usage across the enterprise, using tools like the NTLM blocker in Windows 11 to enforce a deny-by-default posture.

Furthermore, the public disclosure of this flaw is likely to lead to weaponized exploits in the near future. Threat actors have a history of quickly incorporating AD CS vulnerabilities into their toolkits, as seen with the escalation of PetitPotam and other relay attacks. Proactive hunting for the indicators described in this article, combined with a rigorous patch management process, is essential to prevent domain compromise.

In summary, CVE-2025-54241 is not just another patching exercise; it is a wake-up call to harden your AD CS infrastructure and reduce reliance on NTLM. By implementing the detection and mitigation steps outlined above, you can significantly reduce your attack surface and protect your organization from this sophisticated threat.

Sources

• Microsoft Security Response Center Advisory for CVE-2025-54241 — Confirms the vulnerability details, affected versions, and patch availability.
• NVD Entry for CVE-2025-54241 — Provides the CVSS score and technical description.
• CISA Known Exploited Vulnerabilities Catalog — Reference to check for active exploitation status.

Frequently Asked Questions

What is CVE-2025-54241?

CVE-2025-54241 is an elevation of privilege vulnerability in Active Directory Certificate Services (AD CS) that allows an attacker to relay NTLM authentication to obtain a certificate, potentially leading to domain admin compromise. It was patched by Microsoft in August 2025.

Which Windows Server versions are affected?

All supported Windows Server versions with the AD CS role are affected, including Windows Server 2016, 2019, 2022, and 2025. Refer to the Microsoft advisory for specific KB numbers.

How can I detect exploitation attempts?

Monitor Windows Security Event Logs for certificate enrollment events (IDs 4886 and 4887) with unusual requesters or templates. Use the Sigma rule provided in this article, and also deploy network detection for anomalous HTTP requests to the AD CS web enrollment endpoint.

What is the best mitigation?

Apply the August 2025 security update immediately. Additionally, enable Extended Protection for Authentication on the AD CS server and restrict access to the enrollment endpoint. Consider disabling NTLM if possible.

Is CVE-2025-54241 actively exploited?

As of writing, CISA has not added it to the KEV catalog, but given the critical nature and similar past AD CS flaws, active exploitation is likely in the near future. Patch immediately.

Can I use the provided Sigma rule in production?

Yes, but test it in a lab environment first to reduce false positives. Tune the filter lists to match your organization's legitimate certificate enrollment patterns.

Need expert help with this?

CybernytronX can help you assess your AD CS exposure and implement robust defenses. Our penetration testing services simulate NTLM relay and AD CS attacks to identify weaknesses before adversaries do. We also offer SOC build-out and Ethereon AI threat detection to monitor for these sophisticated threats. Contact us or learn about Ethereon to strengthen your security posture.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.