---
id: 3718
title: "Fixing ESC4 - User has dangerous permissions"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/fixing-esc4-user-has-dangerous-permissions/"
published_at: "2026-04-30 23:32"
tags: ["remediation", "active-directory", "hardening", "adcs", "esc4", "certificate-template"]
phying_url: "https://phying.com/item/3718"
lang: en
---

# Fixing ESC4 - User has dangerous permissions

## Summary

Fixing ESC4: when low-privileged principals hold Owner, Full Control, or Write permissions on an ADCS certificate template they can hijack it to escalate privileges. The fix is removing those ACLs.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2026-04-30 23:32
- **Original:** https://projectblack.io/blog/fixing-esc4-user-has-dangerous-permissions/
- **Phying News:** https://phying.com/item/3718