If certificate enrollment broke after October’s Windows Server update, check the identity validation before enabling an NDES exception.
What changed November 9
CVE-2026-69802 was originally published October 13, 2026. Microsoft’s November 9 advisory revision adds operational guidance: patched Network Device Enrollment Service rejects requests containing a SID in a SAN URI or NTDS CA security extension by default unless a custom NDES policy module is configured. The linked Learn guidance is dated November 6. This is new configuration guidance; Microsoft did not announce a new patch for this revision.
Microsoft rates the underlying remote code execution issue Critical, CVSS 3.1 8.1. MSRC reports no public disclosure or observed exploitation, with exploitation assessed Less Likely. It is absent from the checked KEV catalog; no federal KEV deadline applies. Suggested MSP priority: expedited for NDES certificate-enrollment and MDM trust paths.
Check the NDES role and patch baseline
Applicability depends on the NDES role and certificate request format, not simply the presence of Windows Server or Intune. Microsoft lists Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including listed Core installations. MSRC does not supply a first affected build. These are the October security-update minimums mapped to the CVE; use the applicable supported superseding cumulative update where appropriate.
| Windows Server | October KB | Fixed build |
|---|---|---|
| 2012 | KB5126835 | 6.2.9200.26434 |
| 2012 R2 | KB5126836 | 6.3.9600.23470 |
| 2016 | KB5126868 | 10.0.14393.9612 |
| 2019 | KB5126651 | 10.0.17763.9376 |
| 2022 | KB5126655 | 10.0.20348.5761 |
| 2025 | KB5126646 | 10.0.26100.33650 |
Treat overrides as a trust decision
The documented registry path is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP\OverrideSecureSettings. AllowSIDInSANURI=1 permits SID information in a SAN URI; AllowSIDExtensionInRequest=1 permits the NTDS CA security extension. Configure only the format actually needed. Microsoft warns that these switches accept supplied SID information without independent NDES validation. Enable an exception only when a trusted component, such as the MDM solution, validates that SID. Insufficient validation can permit impersonation, including domain administrator privileges.
Inventory NDES servers, installed updates, policy modules, existing overrides and SCEP request formats across each customer. Review Application events from Microsoft-Windows-NetworkDeviceEnrollmentService: event 59 identifies a rejected SID certificate extension; event 60 identifies a rejected SID SAN URI. Validate the enrollment service’s trusted SID check before considering an override. Coordinate any IIS reset or NDES restart required to apply a justified change, then test representative enrollment, renewal and certificate-based authentication. These are applicability and rollout checks, not evidence of compromise.
The registry settings are compatibility exceptions, not a substitute for the security update. Microsoft does not direct blanket credential rotation or publish an incident-response requirement for this revision. If investigation finds unauthorized certificates or impersonation, escalate through the customer’s incident-response process.
Official sources
CVE-2026-69802 · NDES SID configuration and events · MSRC Oct data · CISA KEV
Original vendor publication October 13, 2026. Material FAQ revision November 9. Last verified November 10, 2026.