MICROSOFT has issued a security update for Active Directory Certificate Services after discovering a flaw that lets low‑privileged domain users pose as a domain controller. The vulnerability, tracked as CVE‑2026‑54121, was rated 8.8 on the CVSS scale and patched during the July 2026 Patch Tuesday release. Successful exploitation could allow an attacker to gain control of an entire Active Directory forest.
The flaw lies in the certificate enrolment process where a broken trust boundary enables a user to modify request attributes and obtain a certificate that mimics a domain controller’s identity. Researchers published a proof‑of‑concept showing the attack works with standard domain user credentials in a test lab. The vulnerability does not require administrative privileges or special software.
Versions of Windows Server that run Active Directory Certificate Services from 2016 through 2022 are affected, though the underlying code is shared across editions. An attacker who can enroll for a certificate can abuse the flaw to request a certificate that grants DC‑level authentication tokens. This could be used to forge Kerberos tickets, manipulate Group Policy or extract sensitive data from the directory.
No threat actor has been observed using CVE‑2026‑54121 in the wild, but the ease of exploitation raises concern for organisations that have not applied the latest updates. Microsoft advised that, pending patch application, administrators can restrict enrolment permissions and enable audit logging for certificate requests as interim measures. The vendor also noted that the patch reinforces both target and object authenticity checks in the enrolment service.
Defenders should start by downloading the update from the Microsoft Security Update Guide and applying it to all domain controllers and member servers that run the Certificate Services role. After installing the patch, review the permissions on certificate templates and remove enrolment rights from groups that do not legitimately need them. Continuous monitoring of Event ID 4886 and 4887 can help detect enrolment attempts that deviate from normal patterns.
Additionally, organisations should consider enabling EC‑2 (Enhanced Key Usage) locking on critical templates and restricting the use of mis‑issued certificates through Certificate Authority policy modules. Regularly reviewing CA logs and maintaining a current baseline of approved certificate requests will reduce the chance that a similar flaw could be leveraged in future attacks. Keeping systems patched remains the most effective defence against this class of vulnerability.