DefensiveSecurity
-
CertiGhostbusters! – Notes about detecting CVE-2026-54121 AD CS exploitation
CVE-2026-54121 – CertiGhost CVE-2026-54121, also known as “Certighost”, is a critical improper-authorization vulnerability in Microsoft Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to achieve full domain takeover. It was patched on July 14, 2026 Patch Tuesday updates, and a Proof of Concept was released 10 days later on Github by…