Dark ReadingElizabeth Montalbano
Microsoft addresses critical AD Cert Services bug CVE-2026-54121
Part of the CVE-2026-54121 story · since 28 Jul
- Tue 28 Jul, 17:41 UTC. Dark Reading, first report. Microsoft addresses critical AD Cert Services bug CVE-2026-54121. This article, 1st of 2.
- Wed 29 Jul, 14:42 UTC. SecurityOnline, its first report on the story. Low priv users hijack the DCs via CVE-2026-54121 flaw.
Microsoft has addressed a severe vulnerability in its Active Directory (AD) Certificate Services, tracked as CVE-2026-54121, which allowed low-privileged users to impersonate a domain controller, potentially compromising the entire AD environment. The flaw stemmed from a broken trust boundary in the certificate enrollment process, enabling attackers to manipulate requests and extract sensitive identity information.
A proof-of-concept exploit was developed, revealing that the flaw could be exploited within a standard enterprise lab setup. Microsoft released a patch on July's Patch Tuesday, reinforcing target authenticity and object authenticity to prevent future exploits. Temporary mitigation strategies were suggested for organizations unable to immediately apply the patch.
How the story developed
2 articles from 2 outlets since 28 Jul. Quiet since 29 Jul. This was the first report.
- Tue 28 Jul, 17:41 UTC. Dark Reading, first report. Microsoft addresses critical AD Cert Services bug CVE-2026-54121. This article, 1st of 2.
- Wed 29 Jul, 14:42 UTC. SecurityOnline, its first report on the story. Low priv users hijack the DCs via CVE-2026-54121 flaw.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 2 articles as a listHide the list
- Tue 28 JulDay 01
- Microsoft addresses critical AD Cert Services bug CVE-2026-5412117:41 · Dark Reading · First report · This article, 1st of 2
- Wed 29 JulDay 11
- Low priv users hijack the DCs via CVE-2026-54121 flaw14:42 · SecurityOnline