[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fklo1eLGLJcZMPJwrbb17VNmJHiOjuomVNUQkL0xfyBI":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"62c83260-7480-47f7-94d0-b9bd04406957","Microsoft Fixes Certighost Flaw That Allowed Domain Controller Impersonation","microsoft-fixes-certighost-flaw-that-allowed-domain-controller-impersonation-524532","Certighost allowed a low-privilege domain user obtain a valid Domain Controller certificate through AD CS. Microsoft patched the issue in the July security updates.","Microsoft has addressed a critical vulnerability (CVE-2026-54121), dubbed Certighost, in Active Directory Certificate Services. This flaw allowed a low-privilege domain user to obtain a certificate impersonating a Domain Controller by tricking the Certification Authority into accepting attacker-controlled identity data. The exploit, demonstrated with a proof-of-concept, could lead to full domain compromise through techniques like DCSync.","Microsoft patched Certighost flaw allowing low-privilege users to impersonate Domain Controllers.","https:\u002F\u002Fhackread.com\u002Fmicrosoft-certighost-flaw-domain-controller-impersonation\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fmicrosoft-certighost-domain-controller-impersonation-2.png","2026-07-27T20:49:40+00:00","2026-07-27T22:00:24.20428+00:00",8,[17,20,23,26],{"name":18,"type":19},"Active Directory Certificate Services","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Kerberos","technology",{"name":27,"type":25},"DCSync","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":53,"value":54,"context":55},"cve","CVE-2026-54121","Certighost vulnerability in Active Directory Certificate Services",[21,18],{"controls":58,"vendors":142},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":89,"name":90,"problem":91,"products":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":110,"vendor_name":21,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":117,"name":118,"problem":119,"products":120},"patch-management","Automated patch management","Known holes get closed in days, not months.",[121,126,134],{"vendor_slug":110,"vendor_name":21,"vendor_logo":111,"product_slug":122,"product_name":123,"url":124,"description":125},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[143],{"slug":110,"name":21,"logo_path":111,"roles":144},[145],"affected",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":161},"certighost-critical-ad-cs-flaw-enables-domain-controller-impersonation","Certighost: Critical AD CS Flaw Enables Domain Controller Impersonation","The Certighost vulnerability (CVE-2026-54121) exposes a fundamental weakness in Active Directory Certificate Services, where insufficient validation of identity data allowed a low-privilege user to obtain a certificate impersonating a Domain Controller. This matters because certificate-based trust is foundational to Active Directory security — once an attacker holds a DC certificate, they can execute DCSync attacks to extract credential hashes for every account in the domain, achieving full domain compromise. The root issue lies in the Certification Authority's failure to enforce strict controls over attacker-controllable identity attributes during certificate enrollment. This class of AD CS vulnerability (similar to ESC family attacks) has become a prime target for ransomware operators and nation-state actors due to its high impact and often-overlooked attack surface.",[151,152,153,154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","CIS Control 5: Account Management","CIS Control 18: Penetration Testing","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-57: Recommendations for Key Management","MITRE ATT&CK T1649: Steal or Forge Authentication Certificates","MITRE ATT&CK T1003.006: DCSync","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented",{}]