[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fY13nvCyQxnzohieDVJCfthbLTj1Ok0FvwC1VL0w6Rtc":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"1baeca42-8959-4734-813d-473c2e115c53","New Certighost PoC exploit lets attackers hijack Windows domains","new-certighost-poc-exploit-lets-attackers-hijack-windows-domains-4911b5","A proof-of-concept exploit for \"Certighost,\" a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain. [...]","A proof-of-concept exploit for the 'Certighost' vulnerability (CVE-2026-54121) in Windows Active Directory Certificate Services has been released. This vulnerability allows authenticated attackers to impersonate domain controllers and gain domain-level administrative privileges by manipulating machine account attributes and obtaining a forged certificate. Microsoft patched this flaw in its July 2026 security updates.","New Certighost PoC exploit allows authenticated attackers to hijack Windows domains.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-certighost-poc-exploit-lets-attackers-hijack-windows-domains\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F10\u002F20\u002FWindows-headpic.jpg","2026-07-27T21:00:25+00:00","2026-07-27T22:00:18.362586+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"Active Directory Certificate Services","product",{"name":21,"type":19},"Windows",{"name":23,"type":24},"PKINIT","technology",{"name":26,"type":24},"Kerberos",{"name":28,"type":24},"SMB",{"name":30,"type":24},"LSA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-54121","Certighost vulnerability in Windows AD CS",[18,21],{"controls":61,"vendors":149},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":92,"name":93,"problem":94,"products":95},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":121,"name":122,"problem":123,"products":124},"patch-management","Automated patch management","Known holes get closed in days, not months.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[150],{"slug":105,"name":106,"logo_path":107,"roles":151},[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":168},"certighost-poc-exploit-enables-windows-domain-hijacking-via-forged-certificates","Certighost PoC Exploit Enables Windows Domain Hijacking via Forged Certificates","The Certighost vulnerability (CVE-2026-54121) exposes a critical flaw in Windows Active Directory Certificate Services (AD CS), allowing authenticated attackers to manipulate machine account attributes and obtain forged certificates to impersonate domain controllers. This effectively grants domain-level administrative privileges, meaning a single compromised account could lead to full enterprise takeover. The public release of a proof-of-concept exploit dramatically lowers the barrier for attackers, making unpatched systems an immediate target. Microsoft issued a patch in July 2026, but organizations that delay deployment remain at severe risk. AD CS misconfigurations and privilege escalation paths have become a recurring attack surface that demands proactive, continuous attention.",[158,159,160,161,162,163,164,165,166,167],"CIS Control 7: Continuous Vulnerability Management","CIS Control 5: Account Management","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","MITRE ATT&CK T1649: Steal or Forge Authentication Certificates","MITRE ATT&CK T1078: Valid Accounts",{}]