Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Microsoft AD CS Certighost improper authorization flaw (CVE-2026-54121)

Vulnerability
First reported
Last updated
Happening score
H score 37
2 unique sources, 2 articles

Summary

Hide ▲

CVE-2026-54121 (Certighost) is a Microsoft Active Directory Certificate Services (AD CS) vulnerability that can let an authenticated attacker obtain a certificate for a machine account or Domain Controller and compromise a Windows domain. Microsoft fixed it in the July 2026 Patch Tuesday updates after researchers H0j3n and Aniq Fakhrul reported the flaw on May 14, 2026. The researchers later released a public proof-of-concept exploit that uses attacker-controlled SMB, LSA, and LDAP services, authenticates through PKINIT, and can lead to DCSync and krbtgt credential recovery. Administrators can temporarily disable the optional chase fallback, but the permanent fix is the July update.

Related Happenings

Azure Cosmos DB Gremlin query sandbox escape security flaw

Vulnerability
H score30 First: 30.07.2026 16:34 Last: 30.07.2026 16:34 Sources 1

About this happening: A now-patched Azure Cosmos DB vulnerability let an attacker escape the Gremlin query sandbox and could expose full read and write access across customer tenants. The e...

Open Happening

CCB urgent patch warning for CVE-2026-41089 on Windows servers

Public Sector Action
H score48 First: 01.06.2026 15:30 Last: 01.06.2026 15:30 Sources 1

About this happening: Belgium's CCB warned that CVE-2026-41089 is being actively exploited in the wild, urging admins to immediately patch vulnerable Windows servers because the fla...

Open Happening

Microsoft Secure Boot certificate expiration guidance for Windows devices

Advisory/Mitigation
H score48 First: 14.01.2026 11:38 Last: 14.01.2026 11:38 Sources 1

About this happening: Microsoft warned that Secure Boot certificates used by most Windows devices expire starting in June 2026, creating a risk that some personal and business systems may n...

Latest development: 10.02.2026 21:06

Microsoft released Windows 10 KB5075912 and continues rolling out replacement Secure Boot certificates to targeted Windows devices through monthly Windows updates, expanding delivery only after devices show sufficient successful update signals ahead of the June 2026 expiration.

Open Happening

Timeline

  1. 24.07.2026 17:15 1 articles · 13d ago

    Researchers report AD CS flaw to Microsoft

    Initial Disclosure

    Researchers H0j3n and Aniq Fakhrul reported the Microsoft Active Directory Certificate Services (AD CS) improper-authorization flaw to Microsoft after finding that a low-privileged Active Directory user could obtain a certificate for a Domain Controller and authenticate as that machine.

    Show sources
    Open in new tab
  3. 24.07.2026 17:15 1 articles · 13d ago

    Microsoft patches AD CS chase handling in July update

    Mitigation Patch Update

    Microsoft's July 14 updates for Active Directory Certificate Services fixed CVE-2026-54121 by adding CRequestInstance::_ValidateChaseTargetIsDC in certpdef.dll, which rejects invalid cdc targets and requires a matching Active Directory computer object with SERVER_TRUST_ACCOUNT (8192) before the CA follows a chase.

    Show sources
    Open in new tab
  4. 24.07.2026 17:15 3 articles · 13d ago

    Researchers publish the Certighost Domain Controller impersonation exploit

    Technical Analysis Update

    Researchers H0j3n and Aniq Fakhrul publicly released the working Certighost exploit, showing that a low-privileged Active Directory user can chain a rogue SMB and LDAP listener with a Netlogon relay to obtain a Domain Controller certificate, authenticate with PKINIT, and reach DCSync access to secrets such as krbtgt.

    Show sources
    Open in new tab