Active Directory Certificate Services (AD CS) remains an actively exploited escalation path enabling full domain compromise from low-privileged footholds, with ransomware operators and state-sponsored actors both documented as active exploiters. Unit 42’s analysis confirms a five-phase attack lifecycle that bypasses signature-based defenses, anchored by CVE-2022-26923 (CVSS 7.5) and misconfigured certificate templates that most organizations leave in place out of fear of disrupting legacy authentication workflows. The persistence of this threat reflects a structural gap: known-exploitable configurations are present in production because template modification introduces operational change risk that many organizations defer, creating a window where the security risk remains unmitigated.