CVE-2026-54121PoC(microsoft / windows_10_1607)

Happy to share a technical analysis by @h0j3n on our recent CVE-2026-54121 a.k.a Certighost. glhf🔥 Technical analysis: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 POC: https://github.com/aniqfakhrul/CVE-2026-54121 https://t.co/sQeWImc8HP

CertiGhost (CVE-2026-54121) deserves much more attention than it is getting right now, from my point of view. In a common/default AD CS setup, a low-privileged domain user can create a rogue machine account, trick the CA into issuing a certificate with the identity of a Domain Controller, authenticate as that DC via PKINIT, gain replication access and basically compromise the whole domain. So if you run on-prem Active Directory with AD CS and your CA is still unpatched, an ordinary domain user may currently have a path to the highest privileges in your domain. Patch it, obviously, or apply the temporary mitigation. But if you patched only recently, the harder and from my point of view more important question is: did someone already exploit it? A patch closes the hole. It does not unfuck a domain that was already compromised. I put a list of things I would check in the first reply. Overview: https://www.linkedin.com/posts/martinsohn_critical-ad-certificate-services-vulnerability-share-7486503090280460288-vMfz/ Technical details: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 PoC: https://github.com/aniqfakhrul/CVE-2026-54121 Microsoft advisory: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-54121 Temporary mitigation: https://x.com/aniqfakhrul/status/2080590333365084235

👻Certighost (CVE-2026-54121) Detection A newly disclosed Active Directory Certificate Services (AD CS) vulnerability, dubbed Certighost, allowed a low-privilege domain user to impersonate a Domain Controller and take over an entire Active Directory domain. https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 👇 A Sentinel KQL to help detect AD CS abuse. https://detections.ai/share/rule/51w2NnIM #Cybersecurity #Certighost #ThreatHunting

Yes, CVE-2026-54121 is bad with a public working exploit out now (CertiGhost)… although it’s still worth noting that proper network segmentation would mitigate this. Also, the attacker must have a way to run a fake LDAP server, which is not hard if you already have access to the victim machine. Here’s a flow chart to visualize how bad this is: Attacker (low-privileged user) | | 1. Creates a | computer account v Starts fake LDAP server | | 2. Requests a | certificate for | Domain Controller | DC01 v Certificate Authority | | "I'll contact the | LDAP server you | told me about..." v Fake LDAP server controlled by attacker | | "Yep, that's DC01" v ❌!!! VULNERABILITY !!!❌ CA trusts the LDAP response WITHOUT properly verifying that it came from the real Domain Controller. | v CA issues a Domain Controller certificate to the attacker | v Attacker authenticates AS the Domain Controller | v Performs DCSync | v Full Active Directory compromise ✅ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121

Detect the Certighost with NetExec🔥 Thanks to @Xed_sama, the enum_cve module of NetExec will now detect if a host has not been patched and is potentially vulnerable to the Certighost vulnerability (CVE-2026-54121)🚀 https://t.co/K7Y5hcWYmE

Certighost (CVE-2026-54121) - AD CS Domain Controller Impersonation Low-privileged domain user can impersonate a Domain Controller via an AD CS enrollment chase fallback. By supplying cdc (Client DC) and rmd (Remote Domain) request attributes, an attacker forces the Enterprise CA to query an attacker-controlled host over SMB and LDAP The CA then blindly trusts the returned directory objects (objectSid + dNSHostName of a real DC) and issues a certificate containing strong identity mapping for the Domain Controller. This allows successful PKINIT authentication as the DC ADCS is often a quick way to escalate privileges, and admins overlook its security importance.. Source: https://github.com/aniqfakhrul/CVE-2026-54121

GitHub - tc4dy/CVE-2026-54121-PoC-Exploit: 👻 CVE-2026-54121 - Best CertiGhost AD CS Multi-Exploit Framework ⚡Weaponized tool with rogue DC/LDAP servers, certificate abuse, PKINIT hash extraction. Features: detect safe check, exploit full multi-threaded. https://github.com/tc4dy/CVE-2026-54121-PoC-Exploit

Microsoft released security updates on July 14, 2026, to address CVE-2026-54121 (Certighost), an elevation-of-privilege vulnerability in Active Directory Certificate Services (AD CS). An authenticated, low-privileged attacker with network access could manipulate certificate enrollment to impersonate a Domain Controller, potentially enabling privileged operations and full domain compromise. Exploitation requires no administrative privileges or user interaction, but does require network access and a valid domain account. The publication of proof-of-concept code increases the likelihood of exploitation attempts, so we recommend customers prioritize installing the July 2026 security update as soon as possible. Microsoft has observed researcher testing activity but has not confirmed active exploitation by threat actors. In response to these early signs of activity, we are sharing detection and hunting guidance to help defenders identify potential exploitation attempts, particularly in environments where the security update has not yet been applied. Microsoft Defender detects malicious certificate requests associated with this vulnerability and generates the alert: - “Potential Certighost (CVE-2026-54121) AD CS abuse.” - "Active Directory Certificate Services attack tool activity " Other alerts, including the following, may also appear during the attack chain. These signals support investigation but are not independently specific to Certighost. - Security principal reconnaissance (LDAP) - Suspicious Active Directory Certificate Services abuse tool activity - Suspected suspicious Kerberos ticket request - DCSync attack (replication of directory services) Customers should apply the July 14, 2026 security update to every server running an Enterprise Certification Authority (CA). The security update provides the primary protection by validating the enrollment chase target before the CA contacts it, preventing invalid or attacker-controlled systems from influencing certificate issuance. Customers who can't apply the July 14, 2026 security update immediately for all affected servers, should consider configuring the following audit logs to enable the mentioned detections and forensic: - Enable Certification Services auditing for both successful and failed operations. - Configure the CA audit filter to capture certificate lifecycle activity. - Monitor Security events 4886 and 4887 for anomalous certificate requests and issuance. - Investigate certificates requested through machine templates that contain unexpected Domain Controller identity information.

If you want to hunt for signs of Certighost (CVE-2026-54121) by @h0j3n and @aniqfakhrul in your #XDR environment try this query. 1. Exclude DCs 2. Identify ADCS servers 3. Check for LDAP or SMB connectivity to any non DC from ADCS BP for SMB possible! https://gist.github.com/f-bader/8c447a8f3b58cb8a85bcf013436e312b

🚨 A public PoC has been released for CVE-2026-54121 affecting Microsoft Active Directory Certificate Services (AD CS). The vulnerability allows an authorized attacker to escalate privileges over the network. 🔗 https://github.com/aniqfakhrul/cve-2026-54121 #Microsoft #ADCS #PrivilegeEscalation

🚨AD CSの権限昇格脆弱性「CVE-2026-54121（CertiGhost）」について。 KEV未掲載、Vulnrichmentはにおいて、現時点でExploitation: Noneですが、PoCと攻撃手法は既に公開済み。 該当環境においては早急なアップデートを推奨します。 https://t.co/jKguOFPPFH

🚨 Sharing some detection opportunities and queries for #Certighost #CVE-2026-54121 https://github.com/Cyb3r-Monk/Threat-Hunting-and-Detection/blob/main/Uncategorized/Certighost%20CVE-2026-54121.md #ThreatHunting #DetectionEngineering

Any domain user. Domain Controller certificate. Full domain compromise. One Python script. Default configuration. Certighost (CVE-2026-54121, CVSS 8.8) abuses the AD CS enrollment chase fallback. The CA reads an attacker-controlled `cdc` attribute and follows it to a rogue host without ever checking if the target is a real Domain Controller. Create a machine account via the default MachineAccountQuota. Spin up rogue LDAP and SMB listeners. The CA connects back, authenticates through the real DC via Netlogon, but your rogue LDAP returns the target DC's objectSid and dNSHostName instead. The CA issues a valid Domain Controller certificate. PKINIT with the DC's PFX. DCSync the entire domain. Extract krbtgt. Game over. Works with the default Machine template and default ACLs. No special configuration required. Patched July 14, 2026. PoC dropped yesterday. If your AD CS hosts are not patched, this is your priority. Temporary mitigation: certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 Authors: @h0j3n @aniqfakhrul #ActiveDirectory #InfoSec #BlueTeam

AD運用者には悪夢そのものだ。 Certighost（CVE-2026-54121、CVSS 8.8）のPoCが7月24日に公開。低権限のDomain UserがDC証明書を取得し、そのDCとして認証できる。DCSyncでkrbtgtまで抜かれれば、domain全体を握られる。 PoCはcomputer account作成からPFXとKerberos credential cache取得まで自動化済み。自分ならAD CSのCAへ7月14日更新を最優先で適用し、CAのSecurity event 4886／4887のAttributesでcdc／rmdとDC名への発行を追う。既定のms-DS-MachineAccountQuota=10も攻撃を助けるが、0にするだけでは既存accountの再利用を止められない。未更新CAは優先度を上げて棚卸ししてほしい。#セキュリティ ソース: https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html

🚨 If you haven’t patched your AD CS servers yet, now is the time. A public PoC for Certighost (CVE-2026-54121) is now available. https://www.linkedin.com/posts/georgpheheise_certighost-ugcPost-7486673216711573504-3vji/?utm_source=social_share_send&utm_medium=ios_app&rcm=ACoAAAQjR5wB3BWYOlhqYqQ2X1SBaai1tyYbAWo&utm_campaign=copy_link #certighost #ADCS #activedirectory #redteaming https://t.co/oEV1cni6PJ

Exploit Certighost permite que usuarios de Active Directory con bajos privilegios suplanten a un Controlador de Dominio Investigadores descubrieron Certighost (CVE-2026-54121), una vulnerabilidad en AD CS que permite a usuarios con pocos privilegios obtener certificados de controladores de dominio. Esto facilita la suplantación de identidad y la extracción de secretos críticos como krbtgt mediante DCSync https://blog.elhacker.net/2026/07/exploit-certighost-permite-que-usuarios.html

Certighost (CVE-2026-54121) Authors: h0j3n, aniqfakhrul
 Credit/Source: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 https://t.co/FQZV4U7nr1

We reproduced Certighost (CVE-2026-54121) end to end in a controlled lab The vulnerability allows a low-privileged domain user to obtain a certificate for a Domain Controller, authenticate as that DC, and eventually perform DCSync to extract credentials from the entire domain In the post, we walk through the full attack chain, show the traces left behind on the Certificate Authority, Domain Controller, and network layer, and map seven Sigma rules to the exact point where they would have triggered during exploitation We also explain why some of the most useful ADCS events are missing unless two separate auditing controls are enabled, and provide a read-only checker to assess whether a CA is exposed https://www.nextron-systems.com/2026/08/04/detecting-certighost-cve-2026-54121-sigma-coverage-across-the-full-attack-chain/

Certighost (CVE-2026-54121) An Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration. The issue was addressed in the July 2026 security updates. https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

''CVE-2026-54121.md'' #infosec #pentest #redteam #blueteam https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26