CVE-2026-54121
CVSS 8.8 HIGH: improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate… Microsoft patch: 5099538.
Patch available KB5099538 Download →
Vulnerabilities & Exploits
Researchers published a working proof-of-concept on July 24 for Certighost, tracked as CVE-2026-54121, showing that a standard Active Directory user can coerce Microsoft Active Directory Certificate Services (AD CS) into issuing a valid Domain Controller certificate. Microsoft shipped the fix on July 14.
The flaw is in AD CS "chase" behavior: the Enterprise CA follows requester-supplied routing data, accepts identity details from an attacker-controlled machine, and signs them as if they came from a real Domain Controller. Once that certificate exists, the attacker can use it for Kerberos public-key logon and reach Domain Controller-level trust.
That makes the blast radius Tier 0. Any environment that treats Enterprise CAs, smart card logon, or internal PKI as ordinary infrastructure inherits a trust problem: if the CA can be fooled into minting DC identity, the authentication boundary between a normal domain user and domain-wide control collapses.
1 source · Aug 17
CVSS 8.8 HIGH: improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate… Microsoft patch: 5099538.
Patch available KB5099538 Download →
BleepingComputer
Certighost and the Privilege Hiding in Your Certificate Authority
CVE-2026-54121 lets a standard domain user turn your Enterprise CA into a Domain Controller.
originalPart of the PlainSec briefing for 2026-08-17
Every edition of this story: Certighost Lets a Domain User Impersonate a DC