Improper authorization in Active Directory Certificate Services

CVE-2026-54121 is an improper authorization bug (CWE-285) in the certificate enrollment pipeline of Active Directory Certificate Services. Any authenticated domain principal — including low-privileged users and low-value machine accounts — can coerce the CA into issuing a certificate that authenticates as a higher-privileged account, up to and including domain controllers. The bug affects the AD CS role on Windows Server 2012 R2, 2016, 2019, 2022, and 2025, plus shared code paths in Windows 10 1607/1809. Fixed builds land in the July 14, 2026 rollups: Server 2025 26100.33158 (KB5099536), Server 2022 20348.5386 (KB5099540), Server 2019 17763.9020 (KB5099538), and Server 2016 14393.9339 (KB5099535); 2012/2012 R2 receive parity fixes via ESU.

Microsoft's 8.8 / HIGH label is defensible on paper — PR:L, AV:N, no UI — but it misses the *role multiplier*. AD CS is the trust root. Every prior AD CS EoP class (ESC1–ESC13, Certifried/CVE-2022-26923, ESC15) has ended in the same place: silver-bullet certificates that unlock Kerberos as any principal. This one behaves the same way. Reassessed to CRITICAL 9.6 because the affected component is a canonical high-value-role component and the chain terminates in domain compromise.

Why this verdict

• Role multiplier: AD CS IS the Tier-0 trust root. Documented chain succeeds in the canonical high-value role (enterprise CA issuing auth certs for the forest); blast radius is fleet + identity + persistence via silver-bullet certs. Verdict floor is CRITICAL by the deployment-role rule.
• Prerequisite tax is trivial: PR:L means *any* domain principal, and MachineAccountQuota=10 default lets an attacker manufacture that principal from a single phished credential. The 'authenticated' friction that would downgrade a normal EoP does not apply here.
• Historical base rate: Every AD CS improper-authz / template-abuse class since 2021 (Certifried, ESC1, ESC8 relay, ESC15) reached weaponized public tooling within 60 days and became a preferred APT and ransomware primitive.
• Persistence multiplier: Certificates issued during the exploitation window remain valid for years and survive password resets and full krbtgt rotation unless explicitly revoked — this is a compounding downward pressure on time-to-recover.
• No compensating friction on the target side: AD CS is on the LAN by definition; there is no WAF, no email gateway, no MFA layer between a domain user and \\CA\pipe\cert.

Why not higher?

Not scored a 10.0 because we have not yet confirmed the bypass evades Strong Certificate Mapping enforcement mode (KB5014754 Full Enforcement, mandatory since Feb 2025), which would blunt exploitation on hardened forests. If a public PoC lands showing SCM bypass, this becomes a 10.0.

Why not lower?

Cannot be dropped to HIGH: the deployment-role floor forbids it. AD CS is by definition a Tier-0 asset and the chain terminates in DA in the canonical deployment, so friction cannot pull the verdict below CRITICAL without evidence that <1% of installed AD CS servers are actually exploitable — no such evidence exists.

1. Set ms-DS-MachineAccountQuota to 0 forest-wide — Removes the cheapest path for a low-priv user to manufacture a fresh principal to enroll from. Deploy within the noisgate CRITICAL 3-day mitigation window via a domain-wide Set-ADDomain -Replace @{'ms-DS-MachineAccountQuota'=0}. Delegate machine-join to a controlled service account.
2. Enforce Strong Certificate Mapping (KB5014754) Full Enforcement mode — Set StrongCertificateBindingEnforcement=2 on every domain controller and CertificateMappingMethods to require SID-extension binding. This rejects PKINIT with certificates that lack a bound SID — the same defense that neutered Certifried. Deploy within 3 days.
3. Disable NTLM and web enrollment on the CA; require HTTPS + EPA where enrollment is exposed — Cut the ESC8 / web-enroll amplification surface. Registry: on the CA, certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST. Kill IIS binding to HTTP on certsrv vdir.
4. Audit and lock every certificate template — Run Certify.exe find /vulnerable or certipy find from a low-priv account TODAY. Any template with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + client-auth EKU + broad enroll ACL is a bomb regardless of this CVE. Fix inside 3 days.
5. Enable and forward CA audit logs (event IDs 4886/4887) to SIEM with SAN-mismatch analytics — Get eyes on every issued certificate whose SAN/UPN does not match the requesting principal. This is the highest-fidelity indicator for exploitation of this class.
6. Patch every AD CS server to the July 2026 build — This is the remediation, not the mitigation. Apply KB5099536/5099540/5099538/5099535 (or ESU equivalents) to every CA inside the noisgate CRITICAL 90-day remediation SLA, targeting <30 days for CAs given the role.

Run this on each domain controller and each AD CS server as a Domain Admin (or member of local Administrators on the CA). It checks the OS build against the July 2026 patched builds and verifies whether the AD CS role is installed. Invoke: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-54121.ps1. Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN.

#requires -RunAsAdministrator
# Check-CVE-2026-54121.ps1
# Verifies patch level for CVE-2026-54121 (AD CS improper authorization, July 2026)

$ErrorActionPreference = 'Stop'

# Fixed build minimums per KB (build.revision)
$fixedBuilds = @{
    '10.0.26100' = 33158   # Server 2025  - KB5099536
    '10.0.20348' = 5386    # Server 2022  - KB5099540
    '10.0.17763' = 9020    # Server 2019  - KB5099538
    '10.0.14393' = 9339    # Server 2016  - KB5099535
    '6.3.9600'   = 23291   # Server 2012 R2 ESU
    '6.2.9200'   = 26226   # Server 2012 ESU
}

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $ver = [Version]$os.Version
    $key = "{0}.{1}.{2}" -f $ver.Major, $ver.Minor, $ver.Build

    # Detect AD CS role
    $adcs = $false
    try {
        $role = Get-WindowsFeature -Name AD-Certificate -ErrorAction SilentlyContinue
        if ($role -and $role.Installed) { $adcs = $true }
    } catch {}

    # Also check for CertSvc service (works on non-server SKUs)
    if (-not $adcs) {
        $svc = Get-Service -Name CertSvc -ErrorAction SilentlyContinue
        if ($svc) { $adcs = $true }
    }

    Write-Host "Host:          $($env:COMPUTERNAME)"
    Write-Host "OS Version:    $($os.Caption) ($key.$($ver.Revision))"
    Write-Host "AD CS role:    $adcs"

    if (-not $adcs) {
        Write-Host "RESULT: NOT_APPLICABLE (AD CS role not present) — still patch as part of monthly rollup." -ForegroundColor Yellow
    }

    if (-not $fixedBuilds.ContainsKey($key)) {
        Write-Host "RESULT: UNKNOWN — unrecognized OS build $key" -ForegroundColor Yellow
        exit 2
    }

    $required = $fixedBuilds[$key]
    $actual   = [int]$ver.Revision

    if ($actual -ge $required) {
        Write-Host "RESULT: PATCHED (revision $actual >= required $required)" -ForegroundColor Green
        exit 0
    } else {
        Write-Host "RESULT: VULNERABLE (revision $actual < required $required)" -ForegroundColor Red
        if ($adcs) { Write-Host "CRITICAL: AD CS role is installed and unpatched. Apply July 2026 rollup within 3 days." -ForegroundColor Red }
        exit 1
    }
} catch {
    Write-Host "RESULT: UNKNOWN — $($_.Exception.Message)" -ForegroundColor Yellow
    exit 2
}

Sources

1. NVD — CVE-2026-54121
2. CrowdStrike — July 2026 Patch Tuesday Analysis
3. Windows News — Microsoft's July 2026 Update Fixes AD CS Flaw
4. Windows News — Patch Your Domain Controllers Now
5. CrowdStrike — Investigating AD CS Abuse: ESC1
6. Wolf & Company — How Attackers Exploit AD CS
7. SpecterOps — Certified Pre-Owned (ESC1–ESC8 whitepaper)
8. MSRC — KB5014754 Certificate-based Kerberos authentication changes