CVE-2026-54121

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 0.78%
EPSS Percentile: 55.45%
CISA KEV: Not listed

Description

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 15-Jul-2026 01:18
Last Modified: 22-Jul-2026 02:54
EPSS Date: 2026-10-24
CWE: CWE-285

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

microsoft / windows_10_1607
Version / affected range: * · before (exclusive) 10.0.14393.9339
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
microsoft / windows_10_1607
Version / affected range: * · before (exclusive) 10.0.14393.9339
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
microsoft / windows_10_1809
Version / affected range: * · before (exclusive) 10.0.17763.9020
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
microsoft / windows_10_1809
Version / affected range: * · before (exclusive) 10.0.17763.9020
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
microsoft / windows_server_2012
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft / windows_server_2012
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
microsoft / windows_server_2016
Version / affected range: * · before (exclusive) 10.0.14393.9339
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft / windows_server_2019
Version / affected range: * · before (exclusive) 10.0.17763.9020
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft / windows_server_2022
Version / affected range: * · before (exclusive) 10.0.20348.5386
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft / windows_server_2025
Version / affected range: * · before (exclusive) 10.0.26100.33158
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 25-Oct-2026 02:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Certighost (CVE-2026-54121) is a critical Active Directory Certificate Services flaw that lets a low-privileged domain user trick an Enterprise CA into issuing a Domain Controller authentication certificate, potentially Certighost Flaw Lets Low-Privilege AD Users Impersonate Domain Controllers
A proof-of-concept exploit for Certighost, tracked as CVE-2026-54121, shows how an authenticated attacker could abuse Active Directory Certificate Services to impersonate a domain controller and potentially compromise a Certighost PoC Shows How CVE-2026-54121 Can Enable Windows Domain Compromise
Microsoft patched the issue as CVE-2026-54121 in its July 14 update, and the researchers also published a proof-of-concept exploit that automates the attack chain. Certighost AD CS Flaw Lets Low-Privilege Users Impersonate Domain Controllers

People (2)

MITRE ATT&CK (6)

Vendors (1)

Products (5)

Tools (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.