New Flaw Lets Ordinary Users Hijack Windows Certificate Authorities
A newly disclosed vulnerability, tracked as CVE-2026-54121 and nicknamed "Certighost," targets Active Directory Certificate Services (AD CS). Researchers found that under common configurations, a low-privileged domain user can abuse certificate enrollment and template logic to escalate all the way to Domain Controller privileges.
The bug isn't just a coding error to patch and forget. It highlights that certificate authorities function as Tier 0 identity infrastructure, on par with domain controllers themselves, yet are frequently deployed with default or loosely audited permissions. Because certificates can be used to authenticate as any account, a compromised CA effectively hands over the keys to the entire domain.
Microsoft has issued a patch, but security teams are being urged to also review CA templates, enrollment permissions, and standing access rights rather than treating this as a simple update-and-move-on fix.