ESC16 — Security Extension Disabled on CA
External: Hacker Recipes — ESC16
External: Internal All The Things — Certificate ESC16
Idea: CA has security extension disabled (EDITF_DISABLEEXTENSIONLIST or related) → templates may not enforce UPN mapping → abuse like ESC6 / ESC9.
Detect
grep -i ESC16 *_Certipy.txt
certipy-ad find ... | grep -i "Security Extension"Exploit
If SAN in request works → ESC1 / ESC6.
If UPN swap + no security extension template → ESC9.