[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBwAuRTu_rzi7DVOrhhk7l-XgmvH7O2yBro_PlgJweng":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"3e11cb51-c3a9-4848-89e0-59ed36e533b9","Certighost and the Privilege Hiding in Your Certificate Authority","certighost-and-the-privilege-hiding-in-your-certificate-authority-c7510f","CVE-2026-54121 lets a standard domain user turn your Enterprise CA into a Domain Controller. The patch is the easy part. The lesson is standing privilege, implicit trust, and treating PKI as the Tier 0 identity infrastructure it has always been. [...]","Certighost (CVE-2026-54121) is a vulnerability in Microsoft's Active Directory Certificate Services that allows a low-privileged domain user to obtain a certificate impersonating a Domain Controller. This certificate can then be used with PKINIT to gain Domain Controller credentials, enabling full domain compromise. Microsoft has released a patch for this critical flaw.","CVE-2026-54121 allows standard domain users to gain Domain Controller privileges via Enterprise CA.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcertighost-and-the-privilege-hiding-in-your-certificate-authority\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F08\u002F12\u002Fcertification-authority-header.jpg","2026-08-17T14:00:10+00:00","2026-08-17T16:00:16.512824+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Active Directory Certificate Services","product",{"name":21,"type":22},"PKI","technology",{"name":24,"type":22},"Kerberos",{"name":26,"type":22},"PKINIT",{"name":28,"type":29},"Microsoft","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-54121","Certighost vulnerability allowing privilege escalation",[28,18],{"controls":60,"vendors":143},[61,89,117],{"slug":62,"name":63,"problem":64,"products":65},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":62,"product_name":86,"url":87,"description":88},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":90,"product_name":114,"url":115,"description":116},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":118,"name":119,"problem":120,"products":121},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[122,127,135],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":123,"product_name":124,"url":125,"description":126},"zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[144],{"slug":145,"name":28,"logo_path":146,"roles":147},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":165},"ad-certificate-services-flaw-enables-full-domain-compromise-via-privilege-escalation","AD Certificate Services Flaw Enables Full Domain Compromise via Privilege Escalation","Certighost (CVE-2026-54121) exploits a critical flaw in Microsoft Active Directory Certificate Services (AD CS), allowing any low-privileged domain user to obtain a certificate that impersonates a Domain Controller. By leveraging the PKINIT authentication protocol, an attacker can then authenticate as the Domain Controller itself, achieving full domain compromise with minimal initial access. This attack highlights the dangerous trust placed in PKI infrastructure — when the certificate authority is misconfigured or unpatched, it becomes the master key to the entire domain. The severity is compounded by how widely AD CS is deployed and how quietly it operates, often without robust monitoring. Microsoft has released a patch, making rapid deployment essential for every affected organization.",[154,155,156,157,158,159,160,161,162,163,164],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 6 – Access Control Management","CIS Control 18 – Penetration Testing","NIST SP 800-53 SC-17 – Public Key Infrastructure Certificates","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-57 – Recommendation for Key Management","MITRE ATT&CK T1649 – Steal or Forge Authentication Certificates","MITRE ATT&CK T1078 – Valid Accounts","ITIL – Change and Release Management (patch deployment process)","GDPR Article 32 – Security of Processing (technical measures to ensure integrity)",{}]