CVE-2026-54121 Details

A vulnerability in Active Directory Certificate Services (AD CS) has been identified, allowing an authorized attacker to improperly elevate privileges over a network. This issue arises from improper authorization, enabling attackers to manipulate attributes of machine accounts and obtain certificates that facilitate authentication as those machines via PKINIT. If a Domain Controller account is targeted, the attacker could authenticate as the Domain Controller and execute privileged Active Directory operations.

Users can apply the security update for this vulnerability through the Microsoft Update Catalog. Specific update details can be found in the Microsoft Knowledge Base articles KB5099536, KB5099540, KB5099538, KB5099444, KB5099445, and KB5099535.