6 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
CVE-2026-54121 is a high-severity elevation of privilege vulnerability in Microsoft Active Directory Certificate Services (AD CS). The flaw can allow a low-privileged authenticated attacker to obtain certificates for targeted machine accounts and authenticate as those systems using Kerberos. If leveraged against a domain controller account, successful exploitation could result in full Active Directory domain compromise. Organizations should prioritize applying Microsoft's July 2026 security updates to all AD CS servers.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Active Directory Certificate Services Elevation of Privilege Vulnerability
Identifier: CVE-2026-54121
PoC or Exploitation:
A working public proof-of-concept named Certighost is available. It uses rogue LDAP and SMB services and a manipulated certificate request to obtain a certificate and Kerberos credentials associated with a targeted machine account.
CVSS Score: 8.8 (High, CVSS v3.1)
Update / Patch:
Microsoft addressed the vulnerability in its July 2026 security updates. A system restart is required.
Official Microsoft Advisory:
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-54121
Description:
CVE-2026-54121 is an improper authorization vulnerability in Microsoft Active Directory Certificate Services.
An authenticated attacker with low privileges can manipulate attributes associated with a machine account during certificate enrollment. Under vulnerable conditions, the certification authority may retrieve identity information from an attacker-controlled system and issue a certificate associated with a different machine account.
The resulting certificate can be used through PKINIT to authenticate as the targeted machine. If a domain-controller account is successfully targeted, the attacker could authenticate as that domain controller and perform privileged Active Directory operations, potentially resulting in domain compromise.
Mitigation Recommendation:
Install the applicable Microsoft July 2026 security update immediately, prioritizing servers that host Active Directory Certificate Services.
Identify every enterprise certification authority and ensure each server hosting the Active Directory Certificate Services role is updated. Updating domain controllers alone does not remediate a vulnerable certification authority hosted on a separate server.
If attempted exploitation is suspected, review recently created or modified computer accounts, unexpected certificate requests, issued certificates, and anomalous certificate-based Kerberos authentication. Investigate and revoke unauthorized certificates before considering the environment recovered.
