<- ALL CYBER NEWS
High
Certighost, CVE-2026-54121, Active Directory, AD CS, domain controller, privilege escalation, PetitPotam
Certighost CVE-2026-54121: AD CS Flaw Hijacks Domains
A public PoC for Certighost (CVE-2026-54121) lets a low-priv AD user abuse AD CS to impersonate a domain controller and take over the domain. The next PetitPotam.
Certighost (CVE-2026-54121) is an improper-authorization flaw in Active Directory Certificate Services that lets a low-privileged domain user obtain a certificate authenticating them as a domain controller - a straight path to full domain takeover. A public PoC is now out, and researchers are calling it the next PetitPotam.
What happened. A public proof-of-concept was released for Certighost, tracked as CVE-2026-54121 (CVSS 8.8, CWE-285 improper authorization) in Active Directory Certificate Services (AD CS). By abusing how AD CS handles enrollment, an authorized but low-privileged domain user can coerce the Certification Authority into issuing a certificate that authenticates them as a domain controller - which, via DCSync, means dumping every credential in the domain.
How bad is Certighost?
Detail | Value |
|---|---|
CVE | CVE-2026-54121 |
CVSS | 8.8 High (CWE-285, improper authorization) |
Component | Active Directory Certificate Services (AD CS) |
Requires | A low-privileged authenticated domain user |
Impact | Domain-controller impersonation, then domain takeover |
Public PoC | Yes |
Who is affected. Any Windows environment running AD CS - which is most enterprise Active Directory deployments. The barrier to entry is a single low-privileged account, the kind an attacker gets from any phishing foothold.
Is Certighost like PetitPotam?
The community comparison is apt: like PetitPotam and the ESC family of AD CS abuses, Certighost turns a certificate-services misconfiguration path into privilege escalation up to domain compromise. The difference that matters today is that a working PoC is public, so the barrier has dropped from "expert" to "download and run."
What should you do now?
Apply Microsoft's AD CS fix. In the meantime, review AD CS enrollment permissions and enforce certificate-issuance restrictions and manager approval on sensitive templates, and monitor for anomalous certificate requests and DCSync-style replication from non-DC accounts.
Our read. AD CS is the quiet crown jewel of most Active Directory estates - powerful, widely deployed, and rarely tested like the domain-takeover primitive it can become. A CVSS 8.8 with a low-privilege precondition and a public PoC is precisely the kind of internal path that a compliance checkbox never exercises. The only way to know whether your AD CS is abusable is to have an adversary try it - supervised adversary simulation, not a scan.
Reporting by The Hacker News; severity and component per NVD. Sources linked above.
Related: Microsoft ADFS zero-day in a record Patch Tuesday and our KEV pentest analysis.