Vuln: CVE-2026-54121 | Detection.FYI

Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121)

Sep 19, 2026 · Domain: Endpoint Domain: Identity OS: Windows Use Case: Threat Detection Tactic: Credential Access Tactic: Privilege Escalation Use Case: Active Directory Monitoring Use Case: Vulnerability Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Unknown Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: ES|QL Platform: Windows Vuln: CVE-2026-54121 ·
Share on:

Identifies successful Active Directory Certificate Services (AD CS) certificate issuance events where a machine-account requester differs from the Remote Machine Discovery (RMD) chase target while the event's DNS subject alternative name (SAN) matches that target. This requester-to-target mismatch may indicate CertiGhost (CVE-2026-54121) or similar abuse of AD CS request-context chase processing.

Read More