type: cve · created: 2026-07-25 · updated: 2026-07-25 · tags: [cve, sector-technology, technique] · confidence: high · severity: high · affected_sectors: [technology, government, finance, healthcare] · au_impact: true
CVE-2026-54121 — Certighost AD CS Domain Controller Certificate Theft
CVE-2026-54121 (dubbed Certighost, CVSS 8.8) is a vulnerability in Microsoft Active Directory Certificate Services (AD CS) that allows low-privileged Active Directory users to obtain a certificate for a Domain Controller and authenticate as that machine. This enables DCSync attacks to retrieve the krbtgt secret.
Vulnerability Details
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-54121 |
| CVSS | 8.8 (High) |
| Type | Certificate-based privilege escalation |
| Affected Component | Active Directory Certificate Services (AD CS) |
| Privilege Required | Low-privileged AD user |
| Impact | Domain Controller impersonation → DCSync → krbtgt theft |
| Discovered by | H0j3n and Aniq Fakhrul |
| Fix | Microsoft patched ~10 days prior (July 2026 Patch Tuesday) |
Exploitation Chain
- Low-privileged AD user requests a certificate from AD CS
- Exploit obtains a certificate for a Domain Controller machine account
- Attacker authenticates as the Domain Controller using the stolen certificate
- DCSync attack retrieves the krbtgt hash
- Full domain compromise via Golden Ticket attacks
Australian Significance
AD CS is widely deployed in Australian government and enterprise environments. Organisations should: - Verify the July 2026 Patch Tuesday updates are applied to all AD CS servers - Audit certificate templates for dangerous configurations - Monitor for anomalous certificate requests - Restrict enrollment permissions on sensitive certificate templates
Related Pages
- Certighost Exploit Lets Low Privileged Ad Users Impersonate A Domain Controller — Incident page with broader context