Certighost: The Windows Certificate Flaw That Hands Attackers the Keys to the Kingdom
A newly disclosed bug, CVE-2026-54121, lets any ordinary staff account quietly promote itself to top-level control of a Windows network by abusing the company's certificate server.
Key points
- Microsoft assigned CVE-2026-54121 to a flaw that lets a normal domain user escalate to Domain Controller-level access through an Enterprise Certificate Authority.
- The bug, nicknamed Certighost by researchers, abuses standing permissions on the CA rather than any exotic memory corruption.
- Patching closes the specific bug but does not fix the underlying design habit of treating certificate servers as ordinary application servers.
- Security teams are being told to move Enterprise CAs into the Tier 0 protection tier, the same bracket as Domain Controllers.
- No confirmed exploitation in the wild has been reported at time of writing, though proof-of-concept code is circulating privately.
There is a new Windows bug making the rounds, and it is a nasty one.
It is called Certighost, and it was first reported by BleepingComputer. Microsoft tracks it as CVE-2026-54121. In plain English: a regular employee account, the kind a receptionist or a junior developer might have, can quietly turn itself into an account with god-mode control over the whole company network.
That is a big deal. Let me explain why.
What actually got broken?
An attacker with a normal staff login can abuse the company's certificate server to promote themselves to full network administrator. The server was never meant to hand out that kind of power, but the permissions were sitting there, unused and unwatched.
Most businesses that run Windows have something called an Enterprise Certificate Authority, or CA. Think of it as the office notary: it stamps digital ID cards that let laptops, servers and people prove who they are to each other. Websites do the same thing when your browser shows a padlock.
The problem is that this notary sits inside the same trust system as the Domain Controllers, the master servers that decide who is allowed to do what. If you can lean on the notary hard enough, you can forge an ID card that says you are the boss.
Certighost is a clean way of doing exactly that. The researchers found that the CA holds permissions it does not strictly need, and those permissions can be chained together by an ordinary user to request a certificate that impersonates a Domain Controller.
Is this a brand new type of attack?
Not really, and that is the interesting part. This is the latest entry in a family of attacks that started with the Certifried and ESC1-through-ESC8 research a few years ago. The pattern is always the same: certificate services sitting one rung too low in the trust ladder.
If you have followed web security, the analogy is close to insecure direct object reference. The door is unlocked because nobody expected anyone to try the handle.
Who is affected?
Any organisation running an on-premises Active Directory Certificate Services role on an affected Windows Server build. Cloud-only shops that never stood up their own CA are not in scope. Hybrid environments almost certainly are.
| Item | Detail |
|---|---|
| CVE ID | CVE-2026-54121 |
| Affected role | Active Directory Certificate Services |
| Attacker needs | Any authenticated domain user |
| Result | Domain Controller-equivalent access |
| Fix | Microsoft security update, current patch cycle |
What should defenders do this week?
Install the Microsoft patch, then audit the CA as if it were a Domain Controller, because for practical purposes it is one. Restrict who can log into it, who can enrol certificates on behalf of others, and who can approve templates.
The patch closes the specific path Certighost uses. It does not remove the standing privilege that made the path possible. Teams that only apply the update and move on are setting themselves up for the next variant, and there will be a next variant.
Certificate templates marked with the dangerous "supply subject in request" and "client authentication" combination deserve a fresh review. So does anyone with Enroll or AutoEnroll rights on a sensitive template.
Should ordinary staff worry?
Not directly. You will not click a link and trigger Certighost. This is an inside-the-network problem for IT teams to fix. The reason it matters to everyone else is that once an attacker has this level of access, every file, mailbox and HR record on the network is theirs to read. That is the ransomware nightmare scenario, dressed up in a suit.
