CVE-2026-54121

What it actually does

The flaw is an improper authorization issue in Active Directory Certificate Services (AD CS). A network-accessible, authenticated attacker with low privileges can cause AD CS to perform an action that should require higher authorization, resulting in privilege escalation. Because AD CS can issue certificates that are trusted for Windows authentication, successful exploitation may allow the attacker to obtain or abuse certificates to impersonate higher-privileged identities, potentially including domain users, service accounts, or administrative principals. The CVSS vector indicates low attack complexity, no user interaction, network reachability, and high confidentiality, integrity, and availability impact.

Why it matters to the business

If exploited, this vulnerability can let an attacker turn limited domain access into broad control over Windows identity infrastructure. In practical terms, that may lead to unauthorized access to sensitive systems, domain compromise, persistence through certificate-based authentication, disruption of business services, and costly incident response. Although it is not currently listed in CISA KEV and no public exploit maturity is reported, the affected technology is highly sensitive because AD CS is often trusted across many Windows systems and can enable long-lived access if abused.

How an attack unfolds

An attacker first obtains valid low-privileged domain credentials through phishing, password reuse, malware, exposed services, or another initial access method. From a network position that can reach AD CS components, the attacker interacts with certificate enrollment or certificate services functionality exposed by affected Windows Server deployments. Due to improper authorization, the service incorrectly permits an action that should be restricted. The attacker then uses the resulting certificate, enrollment behavior, or authorization bypass to authenticate as or gain privileges associated with a more powerful identity. With elevated access, the attacker can move laterally, access domain resources, create additional persistence, exfiltrate data, or interfere with business operations. There is no public exploit maturity reported in the provided data, so defenders should focus on patching and hunting for suspicious AD CS enrollment and authentication activity rather than assuming a single known exploit tool or payload.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows and Windows Server systems that host or interact with AD CS, including Windows 10 1607, Windows 10 1809, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so use the vendor’s security update guidance for this CVE and confirm that all AD CS servers, certificate enrollment web services, network device enrollment services, and related Windows components are updated. Prioritize enterprise certificate authorities and domain controllers. As compensating controls, restrict network access to AD CS enrollment services, limit certificate enrollment permissions, remove unnecessary certificate templates, require manager approval or authorized signatures for sensitive templates, audit template permissions, and ensure only expected groups can enroll or auto-enroll. Review AD CS hardening guidance, including disabling legacy or unnecessary enrollment interfaces and enforcing strong mapping for certificate-based authentication where applicable.

How to confirm the fix worked

Confirm that all affected Windows systems have the vendor security update installed and that vulnerability scanners or endpoint management tools no longer report the CVE as missing. Validate AD CS exposure by inventorying certificate authorities, certificate templates, enrollment web services, and network-accessible AD CS endpoints. Review certificate template ACLs and enrollment permissions to ensure low-privileged users cannot request certificates that provide elevated authentication rights. Test from a non-privileged account that sensitive certificate requests are denied or require the expected approval path. Confirm that AD CS auditing is enabled and that certificate request, issuance, template modification, and CA configuration events are being collected centrally. If possible, perform an internal AD CS security assessment using approved tools to verify that no unauthorized privilege escalation path remains.

Typical attack path

1. Acquire valid low-privileged Windows or domain credentials.
2. Enumerate reachable AD CS servers, certificate authorities, enrollment endpoints, and certificate templates.
3. Identify an affected AD CS deployment where authorization checks can be bypassed.
4. Submit or manipulate a certificate-related request over the network using the authenticated account.
5. Obtain or abuse a certificate or certificate service action that grants privileges beyond the attacker’s original account.
6. Use certificate-based authentication or related Windows authentication flows to impersonate a higher-privileged identity.
7. Move laterally to additional Windows hosts and domain resources.
8. Establish persistence, access sensitive data, or perform administrative actions using the elevated privileges.

How to detect it

To determine whether exploitation already occurred, review AD CS and Windows identity telemetry for abnormal certificate activity before and after the patch date. Collect and correlate logs from certification authorities, domain controllers, certificate enrollment web services, endpoint process logs, EDR telemetry, PowerShell logs, IIS logs if web enrollment is enabled, and centralized SIEM data. Look for certificate requests or issuances by low-privileged users that include authentication-capable purposes, unexpected subject alternative names, unusual requester/subject mismatches, requests outside normal administrative workflows, repeated failed and successful enrollment attempts, and sudden use of certificate-based Kerberos authentication. Review Windows Security events related to Certificate Services auditing, including certificate request, approval, issuance, denial, revocation, template change, and CA configuration change events. Investigate use of AD CS enumeration or abuse tools, but also examine native utilities such as certreq.exe, certutil.exe, and PowerShell certificate enrollment commands. Check for newly issued certificates that map to privileged users, domain controllers, service accounts, or administrative groups. If suspicious certificates are found, revoke them, publish updated CRLs/OCSP responses, investigate the requester account, and review downstream authentication events for lateral movement or privilege escalation.

• Event ID 4886
• Event ID 4887
• Event ID 4888
• Event ID 4889
• Event ID 4890
• Event ID 4891
• Event ID 4892
• Event ID 4898
• Event ID 4899
• Event ID 4900
• Certificate Services received a certificate request
• Certificate Services approved a certificate request
• Certificate Services denied a certificate request
• Certificate Services revoked a certificate
• Certificate Services changed a certificate template
• Certificate Services template was updated
• certreq.exe -submit
• certreq.exe -attrib
• certutil.exe -config
• certutil.exe -view
• certutil.exe -pulse
• certutil.exe -template
• Certify.exe
• Certipy
• certipy-ad
• /certsrv/
• /certsrv/certfnsh.asp
• /certsrv/certnew.cer
• /certsrv/certrqxt.asp
• Certificate Enrollment Web Service
• Certificate Enrollment Policy Web Service

What your security team should do

• Prioritize patching AD CS servers and Windows Server systems that provide certificate authority or enrollment functionality.
• Inventory all enterprise certificate authorities, certificate templates, enrollment services, and systems accepting certificate-based authentication.
• Restrict AD CS management and enrollment access to the minimum required users and groups.
• Review certificate templates for dangerous permissions, authentication-capable EKUs, weak subject name controls, and excessive enroll or auto-enroll rights.
• Enable and centralize AD CS audit logs, Windows Security logs, directory service changes, and Kerberos authentication events.
• Hunt for unusual certificate requests, unexpected certificate issuance, template changes, CA configuration changes, and certificate-based logons by low-privileged accounts.
• Rotate or revoke suspicious certificates and investigate any account that requested unexpected authentication-capable certificates.
• Monitor for common AD CS reconnaissance and abuse tooling, but do not rely solely on tool names because the vulnerability may be exploitable through native Windows utilities or custom code.
• Treat confirmed exploitation as a potential identity compromise and investigate lateral movement, privileged account use, and persistence mechanisms.
• Track vendor advisories for fixed build details and any change in exploit maturity, KEV status, or active exploitation reports.