--- schema: 1 kind: vulnerability title: "CVE-2026-54121 — Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)" headline: "Public PoC drops the bar on an AD CS Domain-Controller-impersonation flaw patched in July Patch Tuesday" summary: > Researchers published full exploitation mechanics and a working PoC (2026-07-24) for "Certighost" (CVE-2026-54121), an Active Directory Certificate Services flaw Microsoft patched on 2026-07-14: a low-privileged domain user can make an Enterprise CA issue a certificate carrying a Domain Controller's identity, authenticate as that DC via PKINIT, and DCSync the krbtgt hash. Not seen exploited in the wild, but any AD CS estate that has not applied the July 2026 cumulative update should treat it as weaponizable now. discovered_at: "2026-07-25T04:38:26Z" event_date: "2026-07-24" run_id: 2026-07-25T0409Z-intel priority: high immediate_action: null tags: [vulnerabilities, priv-esc, identity, poc-public, patch-available] regions: [global] sectors: [public-sector, energy, water, transport, healthcare, finance, telco] entities: [] techniques: [T1649, T1003.006, T1078.002] affected_products: ["Microsoft Windows Server"] cves: - id: CVE-2026-54121 cvss: "8.8" epss: null type: priv-esc vector: zero-click auth: post-auth status: [poc-public, patch-available] affected: "Windows Server 2012 through Windows Server 2025 (AD CS Enterprise CA role); also serviced for Windows 10 1607/1809" fixed: "July 2026 cumulative update (released 2026-07-14)" sources: - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121" publisher: "Microsoft MSRC" date: "2026-07-14" role: primary - url: "https://cybersecuritynews.com/certighost-active-directory-cs-flaw/" publisher: "CybersecurityNews" date: "2026-07-24" role: corroborating closed_sources: [] evidence: - quote: "Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network." publisher: "Microsoft MSRC" verification: multi-source sourcing_note: "The CVE, CVSS, patch date and exploitation status are confirmed on Microsoft MSRC (which rates it 'Exploitation Less Likely', not publicly disclosed at patch time, no in-the-wild exploitation). The exploitation mechanics and working PoC are the public 2026-07-24 write-up by researchers H0j3n and aniqfakhrul, as reported by CybersecurityNews." confidence: high update_of: null references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: - "Confirm the July 2026 cumulative update (2026-07-14) is applied to every Enterprise CA — a working low-priv-to-DCSync PoC for this AD CS flaw is now public; unpatched CAs are directly weaponizable." migrated_from: null --- Researchers H0j3n and aniqfakhrul published a full technical write-up and working proof-of-concept on 2026-07-24 for a flaw they call "Certighost" (CVE-2026-54121, CVSS 8.8), an Active Directory Certificate Services vulnerability Microsoft describes as "improper authorization in Active Directory Certificate Services (AD CS) [that] allows an authorized attacker to elevate privileges over a network" and fixed in the July 2026 Patch Tuesday cycle ([Microsoft MSRC, 2026-07-14](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121)). Per the researchers' disclosure, the vulnerable logic sits in the Enterprise CA's enrollment "chase" fallback: when a certificate request carries the `cdc` (client DC) and `rmd` (remote domain) attributes, the CA opened connections to the requester-supplied `cdc` host and trusted the identity data it returned without first proving that host was actually the Domain Controller it claimed to be ([CybersecurityNews, 2026-07-24](https://cybersecuritynews.com/certighost-active-directory-cs-flaw/)). A low-privileged domain user — using only a machine account it can self-register under the default `ms-DS-MachineAccountQuota` — stands up rogue LDAP/LSA services, points the chase at itself, and receives a CA-issued certificate carrying a target Domain Controller's identity. That certificate authenticates via PKINIT as the DC, and the resulting Kerberos ticket grants directory-replication rights; the PoC demonstrates a DCSync pull of the krbtgt secret, making the flaw a single-hop path from an ordinary domain foothold to full domain compromise ([CybersecurityNews, 2026-07-24](https://cybersecuritynews.com/certighost-active-directory-cs-flaw/)). Microsoft rates it "Exploitation Less Likely" and reports no public disclosure at patch time and no in-the-wild exploitation ([Microsoft MSRC, 2026-07-14](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121)); the value of the 2026-07-24 disclosure is that it ships the exploitation chain publicly, collapsing the weaponization bar for any estate that skipped or deferred the July cumulative update. The Microsoft fix adds a CA-side validation step that rejects the chase target unless it resolves to a real computer object whose `userAccountControl` carries the `SERVER_TRUST_ACCOUNT` bit (8192), with a follow-on SID comparison ([CybersecurityNews, 2026-07-24](https://cybersecuritynews.com/certighost-active-directory-cs-flaw/)). **Detection:** on AD CS servers, certificate-request auditing surfaces enrollment requests carrying non-empty `cdc`/`rmd` attributes from workstation or user accounts rather than legitimate cross-domain replication partners; a second, independent hook is outbound SMB/LDAP connections initiated by the CA host itself toward client-segment ranges immediately after a certificate-request event — the CA-to-attacker chase the PoC captures. **Triage:** legitimate cross-forest/cross-domain enrollment chase traffic terminates at an address that already appears in AD as a real DC computer object — the same `SERVER_TRUST_ACCOUNT` + resolved-SID check the patch enforces is exactly the discriminator a hunt should apply. Hardening beyond the patch: audit `ms-DS-MachineAccountQuota` (default 10), since the chain relies on an attacker self-registering a machine account, and review whether chase-eligible cross-domain enrollment is actually required in the environment.