ctipilot.ch

Certighost — Windows Server AD CS elevation of privilege (DC impersonation to DCSync)

cve · CVE-2026-54121

Coverage timeline
1
first 2026-07-25 → last 2026-07-25
Peak priority
high
1 high
Sources cited
2
2 hosts
Sections touched
1
trending-vulnerabilities
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
3
pinned v19.1 · see below

Hunting pivots

ATT&CK techniques
T1003.006T1078.002T1649
Affected products
Microsoft Windows Server
Tags
identitypatch-availablepoc-publicpriv-escvulnerabilities

ATT&CK techniques

3 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Persistence TA0003

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Privilege Escalation TA0004

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Stealth TA0005

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Credential Access TA0006

T1003.006OS Credential Dumping: DCSync×1

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

T1649Steal or Forge Authentication Certificates×1

Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Story timeline

  1. 2026-07-25CVE-2026-54121 — Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)
    trending-vulnerabilitiesPublic PoC drops the bar on an AD CS Domain-Controller-impersonation flaw patched in July Patch Tuesday

Where this entity is cited

  • trending-vulnerabilities1

Source distribution

  • cybersecuritynews.com1 (50%)
  • msrc.microsoft.com1 (50%)

explore in graph

External references

NVD · cve.org · CISA KEV

All cited sources (2)

Entries about Certighost — Windows Server AD CS elevation of privilege (DC impersonation to DCSync) (1)

2026-07-25 · view entry permalink →

HIGHCVE-2026-54121NATOB2

CVE-2026-54121 — Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)

Researchers H0j3n and aniqfakhrul published a full technical write-up and working proof-of-concept on 2026-07-24 for a flaw they call "Certighost" (CVE-2026-54121, CVSS 8.8), an Active Directory Certificate Services vulnerability Microsoft describes as "improper authorization in Active Directory Certificate Services (AD CS) [that] allows an authorized attacker to elevate privileges over a network" and fixed in the July 2026 Patch Tuesday cycle (Microsoft MSRC, 2026-07-14). Per the researchers' disclosure, the vulnerable logic sits in the Enterprise CA's enrollment "chase" fallback: when a certificate request carries the cdc (client DC) and rmd (remote domain) attributes, the CA opened connections to the requester-supplied cdc host and trusted the identity data it returned without first proving that host was actually the Domain Controller it claimed to be (CybersecurityNews, 2026-07-24).

A low-privileged domain user — using only a machine account it can self-register under the default ms-DS-MachineAccountQuota — stands up rogue LDAP/LSA services, points the chase at itself, and receives a CA-issued certificate carrying a target Domain Controller's identity. That certificate authenticates via PKINIT as the DC, and the resulting Kerberos ticket grants directory-replication rights; the PoC demonstrates a DCSync pull of the krbtgt secret, making the flaw a single-hop path from an ordinary domain foothold to full domain compromise (CybersecurityNews, 2026-07-24). Microsoft rates it "Exploitation Less Likely" and reports no public disclosure at patch time and no in-the-wild exploitation (Microsoft MSRC, 2026-07-14); the value of the 2026-07-24 disclosure is that it ships the exploitation chain publicly, collapsing the weaponization bar for any estate that skipped or deferred the July cumulative update.

The Microsoft fix adds a CA-side validation step that rejects the chase target unless it resolves to a real computer object whose userAccountControl carries the SERVER_TRUST_ACCOUNT bit (8192), with a follow-on SID comparison (CybersecurityNews, 2026-07-24).

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

Microsoft MSRC 2026-07-14
vulnerability25 Jul 04:38Zmulti-sourceOpen finding ↗
Sources: Microsoft MSRC · CybersecurityNews