Elevation of Privilege Vulnerability in Microsoft Active Directory Certificate Services
CVE-2026-54121

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Windows 10 Version 1607
Windows 10 Version 1809
Windows Server 2012
Windows Server 2012 (server Core Installation)
Vendor
CVE Published:
14 July 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 29,200💰 Ransomware👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-54121?

CVE-2026-54121 is a vulnerability classified as an Elevation of Privilege issue in Microsoft Active Directory Certificate Services (AD CS). AD CS is a critical component within Microsoft Windows Server that allows organizations to manage digital certificates and public key infrastructure (PKI). The vulnerability arises from improper authorization mechanisms within AD CS, potentially enabling an attacker with valid access to elevate their privileges within a network. If exploited, this could allow the attacker to gain unauthorized access to sensitive data and critical systems, undermining the organization's security posture and trust in the integrity of their certificate management infrastructure.

Potential impact of CVE-2026-54121

  1. Unauthorized Access: The vulnerability could allow attackers to escalate their privileges beyond what is intended, potentially leading to unauthorized access to sensitive resources and data within the organization’s network.

  2. Compromise of Certificate Integrity: With the ability to elevate privileges, attackers might manipulate or issue certificates, which can undermine the reliability and trustworthiness of the organization’s digital certificates and related cryptographic operations.

  3. Increased Risk of Internal Threats: Given that the vulnerability requires authenticated access, the risk of insider threats may increase, as an authorized user can exploit their legitimate access to carry out malicious actions, jeopardizing the organization's cybersecurity framework.

Affected Version(s)

Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.9339

Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.9020

Windows Server 2012 (Server Core installation) x64-based Systems 6.2.9200.0 < 6.2.9200.26226

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-54121
Created by aniqfakhrul

CVE-2026-54121-CertiGhost
Created by KrakenEU

CVE-2026-54121
Created by ChPratik

News Articles

favicon imageBleepingComputer

Certighost and the Privilege Hiding in Your Certificate Authority

CVE-2026-54121 lets a standard domain user turn your Enterprise CA into a Domain Controller. The patch is the easy part. The lesson is standing privilege, implicit trust, and treating PKI as the Tier 0 identity infrastructure it has always been.

3 days ago

favicon imageHelp Net Security

Week in review: Claude breached three companies during tests, AD CS domain-takeover PoC released - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Nono: Open-source sandbox for AI agents AI coding agents

3 weeks ago

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 🥇

    Vulnerability reached the number 1 worldwide trending spot

  • 📈

    Vulnerability started trending

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

.