Zero-Day in Active Directory Certificate Services: Researcher Exposes CVE-2024-49019 with PoC

“An attacker can craft a CSR to include application policies that are preferred over the configured Extended Key Usage attributes specified in the template,” according to the TrustedSec analysis.