Active Directory Certificate Services Elevation of Privilege Vulnerability

What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain domain administrator privileges.

What types of certificates are vulnerable to this type of attack?
Certificates created using a version 1 certificate template with Source of subject name set to "Supplied in the request" are potentially vulnerable if the template is not secured according to the best practices published in the Securing Certificate Templates section of Securing PKI: Technical Controls for Securing PKI | Microsoft Learn.

How do I know if my PKI environment is vulnerable to this type of attack?
Check if you have published any certificates created using a version 1 certificate template where the Source of subject name is set to "Supplied in the request" and the Enroll permissions are granted to a broader set of accounts, such as domain users or domain computers. An example is the built-in Web Server template, but it is not vulnerable by default due to its restricted Enroll permissions.

Security updates
10.0.17763.6532 — https://support.microsoft.com/help/5046615
10.0.20348.2849 — https://support.microsoft.com/help/5046616
10.0.20348.2819 — https://support.microsoft.com/help/5046698
10.0.25398.1251 — https://support.microsoft.com/help/5046618
10.0.14393.7515 — https://support.microsoft.com/help/5046612
6.0.6003.22966 — https://support.microsoft.com/help/5046661
6.0.6003.22966 — https://support.microsoft.com/help/5046639
6.1.7601.27415 — https://support.microsoft.com/help/5046687
6.1.7601.27415 — https://support.microsoft.com/help/5046705
6.2.9200.25165 — https://support.microsoft.com/help/5046697
6.3.9600.22267 — https://support.microsoft.com/help/5046682
10.0.26100.2314 — https://support.microsoft.com/help/5046617
10.0.26100.2240 — https://support.microsoft.com/help/5046696