CVE-2026-54121

Published Jul 14, 2026

Last updated 2 months ago

CVSS high 8.8

Active Directory

Active Directory Certificate Services

AD CS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-54121, also known as "Certighost," is an improper authorization vulnerability found in Microsoft Active Directory Certificate Services (AD CS). This flaw allows an authenticated attacker with low-privilege network access to elevate their privileges within an Active Directory environment. The vulnerability stems from insufficient permission checks during AD CS request handling, specifically within a vulnerable enrollment fallback mechanism known as a "chase" during directory-object resolution. By exploiting this weakness, an attacker can cause the Certification Authority (CA) to follow an attacker-controlled host for identity data, enabling them to impersonate a Domain Controller. This can lead to significant compromise of domain services, including the ability to obtain a certificate representing a privileged account and authenticate to services as that principal. Microsoft released a security update in July 2026 to address this issue.

Description: Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_10_1607, windows_10_1809, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2025

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-285

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "1A8DB50E-7571-4925-A293-CAB93ECD0EBF",
            "versionEndExcluding": "10.0.14393.9339",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "A9DC4EC9-4E72-4CBC-BA0B-39CCC45DB8CE",
            "versionEndExcluding": "10.0.14393.9339",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "643F21D8-3A5B-477D-AFFC-2451DDC472CC",
            "versionEndExcluding": "10.0.17763.9020",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "A68E51D8-C76C-4C9E-9CBD-C7D4D4BCDFAA",
            "versionEndExcluding": "10.0.17763.9020",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
            "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "34D1270A-7D50-46CC-87EE-0A4E25F9C800",
            "versionEndExcluding": "10.0.14393.9339",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D0E1AB94-0B38-4BB7-94EB-988EA266D6D5",
            "versionEndExcluding": "10.0.17763.9020",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9E9A0C18-3AD2-4E59-97AF-A2343E466929",
            "versionEndExcluding": "10.0.20348.5386",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "22BE2FE9-37B9-4FF2-B43A-60A3518E0F08",
            "versionEndExcluding": "10.0.26100.33158",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.