Certighost and the Privilege Hiding in Your Certificate Authority
Teaser from the source
CVE-2026-54121 lets a standard domain user turn your Enterprise CA into a Domain Controller. The patch is the easy part. The lesson is standing privilege, implicit trust, and treating PKI as the Tier 0 identity infrastructure it has always been. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerAffected vendors and products
- Microsoft Microsoft Windows 10 1607
- Microsoft Microsoft Windows 10 1809
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Microsoft Microsoft Windows Server 2012
- Microsoft Windows Server 2012 R2
- Microsoft Windows Server 2012 R2 (server Core Installation)
- Microsoft Windows Server 2012 (server Core Installation)
- Microsoft Microsoft Windows Server 2016
- Microsoft Windows Server 2016 (server Core Installation)
- Microsoft Microsoft Windows Server 2019
- Microsoft Windows Server 2019 (server Core Installation)
More on Certificate
Other advisories
- Not ratedosv:CVE-2026-120250OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections
- Not ratedosv:CLEANSTART-2024-ZR04755When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator
- Not ratedosv:CLEANSTART-2024-TQ32856When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys
- Not ratedosv:CLEANSTART-2025-LY52931Improper Certificate Validation in Node
- Not ratedosv:CLEANSTART-2025-AA04470TLS session reuse can lead to host certificate verification bypass in node version < 12
- Not ratedosv:CLEANSTART-2024-CO07022ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3)
- Not ratedosv:CLEANSTART-2024-UQ58761exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1
- Not ratedosv:CLEANSTART-2024-VO98804OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate
Other news entries
- Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company DataNewsThe Hacker News
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private KeyNewsThe Hacker News
- Vulnerabilities in Node.js Affecting Cisco Products: October 2026NewsCisco PSIRT
- Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate AuthoritiesNewsCisco PSIRT
- TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of DevicesNewsSecurityWeek
- bunny.net pulls an Armenia CDN node after its hosting provider is breached and reissues TLS certificatesBreachpwn.watch
- Microsoft releases Windows OOB updates to distrust eMudhra certificatesNewsBleepingComputer
- GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session DecryptionNewsThe Hacker News
ID