Loading story…
Researchers disclosed a working exploit and public proof-of-concept for Certighost (CVE-2026-54121), a flaw in Microsoft Active Directory Certificate Services that lets a low-privileged domain user obtain a certificate for a legitimate Domain Controller and authenticate as that machine. The issue stems from the AD CS certificate enrollment "chase" fallback, which trusted a requester-supplied directory target without properly verifying it was a real Domain Controller; by relaying the CA's authentication and standing up rogue SMB, LDAP, and LSA services, an attacker can have the CA sign a target DC's identity into a certificate.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Nextron Systems published a defensive writeup for Certighost that reproduced the attack chain in a lab, released a read-only exposure checker, and mapped seven Sigma detection rules to stages including machine account creation, malicious certificate requests, outbound certsrv.exe LDAP/SMB traffic, certificate issuance, and anomalous Kerberos activity. The guidance also documented logging prerequisites for Event IDs 4886 and 4887 and recommended either applying Microsoft's July patch or disabling EDITF_ENABLECHASECLIENTDC where possible.
Researchers H0j3n and Aniq Fakhrul publicly disclosed working exploit details for the AD CS flaw they named Certighost on 2026-07-24. The disclosure showed how a low-privileged Active Directory user could obtain a Domain Controller certificate and potentially perform DCSync to steal secrets such as krbtgt.
Microsoft fixed the Active Directory Certificate Services flaw CVE-2026-54121 on 2026-07-14, adding validation to ensure the certificate enrollment chase target is a legitimate Domain Controller. The issue was rated CVSS 8.8 and addressed as an improper authorization vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
nextron-systems.com
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcegist.github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and defenders warned that **Active Directory Certificate Services (AD CS)** can be abused to take over Windows domains through a combination of certificate misconfigurations and NTLM relay paths. SpecterOps documented multiple escalation techniques in its **Certified Pre-Owned** research, including vulnerable certificate templates, arbitrary Subject Alternative Name abuse, weak access controls, and relay attacks against AD CS web enrollment endpoints. The findings showed that attackers can obtain certificates usable for **PKINIT** or **Schannel** authentication, enabling privilege escalation, persistence that survives password resets, and in some cases creation of forged **"golden certificates"** if a CA private key is stolen. The risk became more urgent as the **PetitPotam** attack chain demonstrated how coercing NTLM authentication from a domain controller and relaying it to AD CS could lead to complete domain compromise. SANS highlighted the issue as a path to **domain admin**, while Microsoft published advisory **`ADV210003`** with mitigations rather than a security patch, recommending steps such as enabling **Extended Protection for Authentication**, requiring **HTTPS** on certificate enrollment endpoints, and reducing or disabling **NTLM** where possible. The combined disclosures showed that widely deployed AD CS environments could become a direct route to full Active Directory takeover if left misconfigured.
Jun 29, 2026
Incident response findings and large-scale Active Directory assessments show that attackers can often escalate from a low-privileged account to **full domain compromise** by chaining common identity weaknesses. Microsoft reported repeated cases of "total identity compromise" tied to excessive privilege, weak password policies, poor credential hygiene, insecure delegation, ACL abuse, Group Policy abuse, trust relationship weaknesses, and exposure of other Tier 0 assets. Separate analysis of 250 PingCastle reports found the same patterns at scale, including delegable administrator accounts, Kerberoast exposure, weak Kerberos encryption, dangerous Group Policy assignments, and exploitable Print Spooler configurations on domain controllers. The assessments also highlighted persistent weaknesses in **Active Directory Certificate Services (AD CS)** and service account management. Research on **Certified Pre-Owned** and AD CS hardening showed that certificate template and enrollment misconfigurations can let attackers impersonate privileged users and gain durable access, while DFIR reporting found widespread service accounts with non-expiring passwords, excessive privileges, and Kerberoastable administrator accounts. Microsoft guidance points defenders toward continuous AD auditing with tools such as Defender for Identity, BloodHound, and PingCastle, along with privilege reduction, stronger authentication, hardened delegation and trust settings, and tighter governance of managed and legacy service accounts to close common escalation paths.
Aug 1, 2026
Microsoft’s November 2024 security updates patched 89 vulnerabilities, including 52 remote code execution flaws and several critical issues across Windows, .NET, Visual Studio, Exchange Server, and Active Directory Certificate Services (AD CS). Among the most notable fixes was **CVE-2024-49019**, an AD CS privilege escalation bug tied to insecure certificate template configurations, alongside actively exploited flaws **CVE-2024-43451** in Windows NT LAN Manager and **CVE-2024-49039** in Windows Task Scheduler. Other critical vulnerabilities addressed included **CVE-2024-43498** in .NET and Visual Studio, **CVE-2024-43625** in Windows VMSwitch, **CVE-2024-43639** in Windows Kerberos, and **CVE-2024-49056** affecting `airlift.microsoft.com`. Research published alongside the updates highlighted how AD CS abuse can extend beyond previously cataloged escalation chains, describing an **EKUwu** technique that leverages certificate Extended Key Usage handling to obtain unintended privileges in misconfigured environments. The findings reinforced that organizations running AD CS face elevated risk when certificate templates are loosely controlled, and they underscored Microsoft’s guidance to rapidly deploy the November patches and review certificate template settings to reduce exposure to privilege escalation and identity compromise.
Jul 24, 2026