CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Certighost, Windows Server AD CS elevation of privilege (DC impersonation to DCSync)

cve · CVE-2026-54121

Coverage
1
first 2026-07-25 → last 2026-07-25
Latest activity
2026-07-25
Public PoC drops the bar on an AD CS Domain-Controller-impersonation flaw patched in July Patch Tuesday
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector, energy, water
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-54121, newest first. Check the date before acting on an older one.

  • Confirm the July 2026 cumulative update (2026-07-14) is applied to every Enterprise CA; a working low-priv-to-DCSync PoC for this AD CS flaw is now public; unpatched CAs are directly weaponizable.
    2026-07-25CVE-2026-54121

Defender insights

What each entry about CVE-2026-54121 tells a defender to do, newest first.

2026-07-25HIGHPublic PoC drops the bar on an AD CS Domain-Controller-impersonation flaw patched in July Patch Tuesday

Triage · detection

Story timeline

  1. 2026-07-25CVE-2026-54121, Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)
    trending-vulnerabilitiesPublic PoC drops the bar on an AD CS Domain-Controller-impersonation flaw patched in July Patch Tuesday

Hunting pivots

Affected products
Microsoft Windows Server
Tags
identitypatch-availablepoc-publicpriv-escvulnerabilities
ATT&CK techniques (3 across 5 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Domain Accounts
  • PersistenceValid Accounts: Domain Accounts
  • Privilege EscalationValid Accounts: Domain Accounts
  • StealthValid Accounts: Domain Accounts
  • Credential AccessOS Credential Dumping: DCSync · Steal or Forge Authentication Certificates

Initial Access TA0001

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Persistence TA0003

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Privilege Escalation TA0004

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Stealth TA0005

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Credential Access TA0006

T1003.006OS Credential Dumping: DCSync×1

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

T1649Steal or Forge Authentication Certificates×1

Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.

Evidence: 2026-07-25/certighost-cve-2026-54121-ad-cs-dc-impersonation-poc · ATT&CK page ↗

Entries about Certighost, Windows Server AD CS elevation of privilege (DC impersonation to DCSync) (1)

2026-07-25 · view entry permalink →

HIGHCVE-2026-54121NATOB2

CVE-2026-54121, Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)

Researchers H0j3n and aniqfakhrul published a full technical write-up and working proof-of-concept on 2026-07-24 for a flaw they call "Certighost" (CVE-2026-54121, CVSS 8.8), an Active Directory Certificate Services vulnerability Microsoft describes as "improper authorization in Active Directory Certificate Services (AD CS) [that] allows an authorized attacker to elevate privileges over a network" and fixed in the July 2026 Patch Tuesday cycle (Microsoft MSRC, 2026-07-14). Per the researchers' disclosure, the vulnerable logic sits in the Enterprise CA's enrollment "chase" fallback: when a certificate request carries the cdc (client DC) and rmd (remote domain) attributes, the CA opened connections to the requester-supplied cdc host and trusted the identity data it returned without first proving that host was actually the Domain Controller it claimed to be (CybersecurityNews, 2026-07-24).

A low-privileged domain user (using only a machine account it can self-register under the default ms-DS-MachineAccountQuota) stands up rogue LDAP/LSA services, points the chase at itself, and receives a CA-issued certificate carrying a target Domain Controller's identity. That certificate authenticates via PKINIT as the DC, and the resulting Kerberos ticket grants directory-replication rights; the PoC demonstrates a DCSync pull of the krbtgt secret, making the flaw a single-hop path from an ordinary domain foothold to full domain compromise (CybersecurityNews, 2026-07-24). Microsoft rates it "Exploitation Less Likely" and reports no public disclosure at patch time and no in-the-wild exploitation (Microsoft MSRC, 2026-07-14); the value of the 2026-07-24 disclosure is that it ships the exploitation chain publicly, collapsing the weaponization bar for any estate that skipped or deferred the July cumulative update.

The Microsoft fix adds a CA-side validation step that rejects the chase target unless it resolves to a real computer object whose userAccountControl carries the SERVER_TRUST_ACCOUNT bit (8192), with a follow-on SID comparison (CybersecurityNews, 2026-07-24).

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

Microsoft MSRC 2026-07-14
vulnerability25 Jul 04:38Zmulti-sourceOpen finding →
Sources: Microsoft MSRC · CybersecurityNews

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cybersecuritynews.com1 (50%)
  • msrc.microsoft.com1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)