#adcs — Byte JMP

◆

Fluffy: Shadow Credentials and ADCS ESC16

Active Directory chain — CVE-2025-24071 hash leak, Shadow Credentials via GenericWrite, and ADCS ESC16 UPN hijack to Domain Admin.

2026-09-04—17 min read