👻 CVE-2026-54121 — CertiGhost

Active Directory Certificate Services (AD CS) Privilege Escalation

👋 Overview

CVE-2026-54121 ("Certighost") is a high-severity privilege escalation vulnerability affecting Microsoft Active Directory Certificate Services (AD CS).

The vulnerability allows an authenticated domain user to abuse certificate enrollment behavior and obtain a certificate capable of impersonating a Domain Controller, potentially leading to full Active Directory compromise.

⚠️ This repository is intended only for authorized security research, detection engineering, and defensive testing.

✨ Features

• 📖 Technical vulnerability explanation
• 🔍 Detection guidance
• 🛡️ Mitigation recommendations
• 🧪 Indicators of Compromise (IoCs)
• 📚 References
• ⚡ Defensive research

📊 Vulnerability Information

🎯 Potential Impact

Successful exploitation may allow an attacker to:

• 👤 Impersonate a Domain Controller
• 🔑 Obtain privileged authentication certificates
• ⚡ Perform PKINIT authentication
• 📂 Execute DCSync attacks
• 🔓 Dump Active Directory secrets
• 👑 Achieve Domain Admin-level compromise

⚙️ Attack Flow

Authenticated User
        │
        ▼
AD CS Certificate Enrollment
        │
        ▼
Authorization Bypass
        │
        ▼
Issue DC Certificate
        │
        ▼
PKINIT Authentication
        │
        ▼
DCSync
        │
        ▼
Full Active Directory Compromise

🔍 Detection

Monitor for:

• Unexpected certificate issuance
• Certificates issued to Domain Controllers
• PKINIT authentication anomalies
• DCSync activity
• Unusual Kerberos events
• CA enrollment spikes

🛡️ Mitigation

• Apply Microsoft's security updates immediately.
• Audit all AD CS templates.
• Restrict enrollment permissions.
• Review CA configuration.
• Monitor Event Logs.
• Monitor certificate issuance.
• Enable continuous AD monitoring.

📁 Repository Structure

CVE-2026-54121/
│
├── README.md
├── LICENSE
├── banner.png
├── docs/
│   ├── advisory.md
│   ├── detection.md
│   └── mitigation.md
├── iocs/
│   └── indicators.md
└── images/

📚 References

• Microsoft Security Advisory
• NIST NVD
• Microsoft MSRC
• Active Directory Certificate Services Documentation

⚠️ Disclaimer

This repository is provided for educational, defensive, and authorized security research purposes only.

The maintainers are not responsible for misuse or unauthorized activities performed using the information contained herein.