{"uuid": "b1c649dc-680c-485b-ba75-d1b99615e66f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54121", "type": "published-proof-of-concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/396", "content": "\ud83d\udd12 Certighost (CVE-2026-54121) \u2014 AD CS Domain Controller Impersonation\n\nLow-privileged domain user can impersonate a Domain Controller via an AD CS enrollment chase fallback. By supplying cdc (Client DC) and rmd (Remote Domain) request attributes, an attacker forces the Enterprise CA to query an attacker-controlled host over SMB and LDAP.\n\nThe CA then blindly trusts the returned directory objects (objectSid + dNSHostName of a real DC) and issues a certificate containing strong identity mapping for the Domain Controller. This allows successful PKINIT authentication as the DC.\n\n\ud83d\udd17 Research:\nhttps://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26\n\n\ud83d\udd17 Source:\nhttps://github.com/aniqfakhrul/CVE-2026-54121\n\n#ad #adcs #pkinit #machineaccountquota", "creation_timestamp": "2026-07-25T00:00:11.252043Z"}