Microsoft Windows Server 2008 Service Pack 2 · Public exploit code

PoC released for privilege elevation flaw in Windows Server

Oct 27, 2026 · 1 min read

A proof of concept for CVE-2025-27740 was released, according to the @ptdbugs account. The flaw is weak authentication in Active Directory Certificate Services and allows an authorized attacker to elevate privileges over a network. The sources mention no fix; teams should locate the affected versions, from Windows Server 2008 SP2 to 2016.

By HIFY Radar newsroom Updated 10/27/2026 04:23 AM Get this every day →← Back to the feed 1 source

MediumVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A proof of concept for CVE-2025-27740 was released, according to the @ptdbugs account. The flaw is in Microsoft Active Directory Certificate Services: weak authentication allows an attacker who is already authorized to elevate privileges over a network.

Why it matters

The affected product list includes Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2 and 2016, including Server Core installations, plus 6 other products not detailed. If exploited, the flaw grants higher privileges on the network to someone who already has authorized access, increasing the risk of internal movement after an initial compromise.

What to do

Inventory now all servers running the listed versions, with attention to those running Active Directory Certificate Services reachable over the network. Monitor anomalous use of authorized accounts until a fix is announced.

For the technical team

CVE: CVE-2025-27740
Affected: Microsoft Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2012 e Windows Server 2012 R2 · Windows Server 2008 SP2, Windows Server 2008 R2 SP1, Windows Server 2012, Windows Server 2012 R2 and Windows Server 2016, each also in Server Core installation, plus 6 additional products not listed in the notice.
Exploitation: PoC/exploit released; reported by the @ptdbugs account (dbugs notice, PT ID PT-2025-15563). No mention of in-the-wild exploitation or KEV listing.
Fix: Fix unconfirmed
Vector: Component: Active Directory Certificate Services (AD CS). Flaw type: weak authentication. Exploitation condition: requires an authorized (authenticated) attacker, acting over the network.
More details: Notice attributed to the @ptdbugs feed, with PT ID PT-2025-15563 and a link to the dbugs database. The flaw grants privilege elevation to an already authorized attacker, so it depends on valid credentials. Incident at PoC stage, with no dates and no fix cited in the sources.