Product
Active Directory Certificate Services
- First Reported
- Jun 5, 2026
- Latest Reported
- Aug 17, 2026
Reported Context (4)
- Certighost (CVE-2026-54121) is a critical Active Directory Certificate Services flaw that lets a low-privileged domain user trick an Enterprise CA into issuing a Domain Controller authentication certificate, potentially Certighost Flaw Lets Low-Privilege AD Users Impersonate Domain Controllers
- Certighost, tracked as CVE-2026-54121, shows how an authenticated attacker could abuse Active Directory Certificate Services to impersonate a domain controller and potentially compromise a Windows domain. Certighost PoC Shows How CVE-2026-54121 Can Enable Windows Domain Compromise
- Researchers H0j3n and Aniq Fakhrul disclosed Certighost, a flaw in Active Directory Certificate Services that can let a low-privileged user obtain a Domain Controller certificate and escalate to DCSync. Certighost AD CS Flaw Lets Low-Privilege Users Impersonate Domain Controllers
- [49:48] Active Directory Certificate Services or Red Team Lab Demonstrates Password Spraying and Active Directory Certificate Abuse
CVE (1)
People (3)
MITRE ATT&CK (8)
Vendors (1)
Products (4)
Tools (9)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.