CISA’s advisory AA26-237A, published Tuesday, documents something that every SOC manager should read slowly. The agency ran simultaneous red team assessments against two critical infrastructure organizations. At one, a government facilities SOC, CISA’s team achieved full domain compromise, lateral movement into cloud resources, and persistent access without generating a single confirmed detection. At the other, a water utility, the same team was detected, quarantined, and forced into an assumed-breach scenario within hours.

The gap between those two outcomes was not budget. It was not headcount. The government SOC ran multiple enterprise security tools. The failure was architectural, and the mechanism was something most organizations will recognize: thousands of high-severity alerts from ordinary business operations had trained the SOC to treat the alert queue as background noise. When real intrusion signals arrived, they arrived into a queue already full of identical-looking false positives. The attackers never needed to evade detection. The alert system evaded it for them.

What CISA’s Team Actually Did

The advisory names three primary lateral-movement enablers at the government target: misconfigured Active Directory Certificate Services, excessive domain trust permissions, and fragmented cloud token controls. Each of these is common. None of them is exotic. The ADCS misconfiguration in particular follows a pattern the security industry has been documenting since SpecterOps published ESC1 through ESC8 attack paths several years ago: certificate templates with client authentication capability, combined with the ENROLLEE_SUPPLIES_SUBJECT flag, allow a low-privileged user to request a certificate as any domain principal, including Domain Admins.

The connection to Monday’s brief is direct. Monday’s report covered CVE-2026-62818, an ADCS remote code execution vulnerability with active exploitation flagged in the August Patch Tuesday release. The CISA advisory confirms what that CVE represents at operational scale: ADCS misconfigurations are not theoretical privilege escalation paths, they are the specific mechanism sophisticated teams use to reach domain-level access. CISA’s red team did not need a CVE to do it. They used a configuration error that has been present in many enterprise Active Directory environments for years.

The cloud token fragmentation problem is the less-discussed half of the failure. The government SOC ran cloud visibility through a separate toolset with no shared telemetry with the on-premises SIEM. When CISA’s team pivoted from compromised domain credentials to cloud resource access using token theft, the on-premises team had no visibility into what was happening in the cloud tenant, and the cloud monitoring had no context from the on-premises compromise. Attackers operating across that seam are effectively invisible to both sides. This is not a gap unique to this organization. Hybrid identity architectures create it by default unless detection engineering explicitly builds correlation rules across both planes, which most teams have not done.

The water utility’s success is the more instructive half of the story. Early detection forced CISA’s team to abandon their initial access objective and switch to an assumed-breach engagement model. The advisory does not elaborate on what the utility did differently, which is frustrating, but the outcome implies unified visibility and a detection stack tuned to behavioral signals rather than signature volume. The utility apparently treated alert quality as an infrastructure problem worth solving. The government SOC, facing the same threat, had allowed alert volume to become an operational norm.

Alert Fatigue Is Not a People Problem

The standard diagnosis for alert fatigue is that analysts are overwhelmed, and the standard prescription is more headcount or better triage tooling. Both miss the actual problem. Alert fatigue is a signal quality problem, and it compounds predictably: organizations that accept high false-positive rates as normal gradually stop distinguishing between noise and signal in their operational processes. Runbooks get written to handle alert volume, not to investigate anomalies. The SOC’s institutional behavior adapts to the environment the alert system creates.

The CISA assessment makes this structural failure visible in the sharpest possible way. The attacker’s best camouflage was not a rootkit or encrypted C2 traffic. It was the organization’s own alert infrastructure generating enough legitimate noise that no analyst could identify the real event. Any security program willing to run the numbers on its true positive rate, as opposed to its raw detection count, will probably find a version of the same problem.

For practitioners: the ADCS misconfigurations named in AA26-237A are auditable now, without waiting for a patch. The advisory recommends disabling the ENROLLEE_SUPPLIES_SUBJECT flag on certificate templates that do not require it, reviewing domain trust configurations for excessive permissions, and building cross-plane correlation rules that link on-premises identity events to cloud access logs. These are configuration hygiene steps. The technical barrier is low. The organizational barrier, getting a team to prioritize reconfiguration over alert triage, is the actual challenge the advisory describes.

Escalation from Monday: ShieldBreak Enters Week Three

As noted in Monday’s brief, CVE-2026-69414 (ShieldBreak) carries a public proof-of-concept and no vendor patch. Two developments since Monday change the operational calculus. Microsoft has not released an out-of-band fix, making this the longest unpatched Windows Defender zero-day with a circulating PoC in recent memory, now past twelve days. More concretely, CISA’s Binding Operational Directive 26-04 sets a mitigation deadline for federal civilian agencies on ShieldBreak’s KEV listing, and that deadline arrives within the next week.

The PoC achieves 100% privilege escalation success against Windows 11 25H2 and Server 2025. The prescribed compensating mitigations are narrow: block low-privilege process spawning from the Malware Protection Engine service (MsMpEng.exe), monitor for SYSTEM-level process creation originating from that process, and disable cloud-delivered file on-demand sync for untrusted paths. Organizations not subject to BOD-26-04 should treat those steps as equivalent urgency. Any attacker with an existing foothold can reach SYSTEM with this PoC today.

What to Watch

Two things could shift materially before next Monday. First, whether Microsoft releases an out-of-band Defender patch for ShieldBreak; the extended silence suggests the fix is not straightforward, which raises the probability of exploitation in the wild before the patch arrives. Second, whether CISA AA26-237A generates follow-on enforcement guidance for ADCS configuration standards across federal agencies. The advisory documents the attack path. A Binding Operational Directive or Emergency Directive mandating ADCS remediation would be the logical next step, and CISA has been willing to move quickly on that mechanism this year.

Security Unlocked publishes threat intelligence and strategic analysis twice weekly. This mid-week brief covers developments from 2026-08-24 through 2026-08-27.