Active-Directory on CuraSec

CVE-2026-54121: Domain User to Domain Controller via Enterprise CA

Tue, 18 Aug 2026 11:37:25 +0000

Engineer — Act: A public PoC exists for a flaw that lets any domain user compromise the Enterprise CA at Domain Controller privilege level — patch CVE-2026-54121 immediately, then audit certificate templates and CA permissions for standing privilege that survives the patch.
SOC/IR — Plan: With a public PoC available but no active exploitation confirmed, build detections for anomalous ADCS activity: unusual certificate enrollment requests by standard users, low-privileged accounts invoking CA RPC interfaces, or certificates issued against sensitive templates — these are the behavioral signals that precede weaponization of this class of bug.
Leader — Plan: This is a useful forcing function to confirm your PKI infrastructure is formally classified and defended as Tier 0 — ask your team to verify the Enterprise CA is in scope for your privileged-access model and that the patch is on an expedited timeline given the public PoC.
Signals: CVE-2026-54121 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Tue, 28 Jul 2026 13:01:43 +0000

Engineer — Act: A public PoC now exists for a domain-hijack flaw in AD Certificate Services; audit your PKI templates for misconfigured enrollment permissions and apply any available patch or Microsoft-recommended mitigation immediately.
SOC/IR — Plan: Build detections for anomalous certificate enrollment requests and CA template abuse (e.g., unusual Enrollee Supplies Subject flag usage); no confirmed active exploitation reported yet, but PoC availability shortens the runway.
Leader — Learn: A PoC for a Windows domain-compromise vulnerability is now public; no board-level action needed yet, but monitor for escalation to active exploitation that could affect enterprise AD environments.

Mon, 27 Jul 2026 15:10:27 +0000

Engineer — Learn: Academic thesis proposing game-theoretic models for AD attack-path hardening, including dynamic graph defense and honeypot placement. No patch or configuration change needed today, but the prioritization framework could inform future AD remediation planning.
SOC/IR — Learn: The decoy/honeypot placement model—designed to maximize worst-case incident response time in dynamic AD environments—is worth reading for analysts building deception layers, though no actionable detection content or IOCs are included.
Leader — Skip

Sat, 25 Jul 2026 12:08:50 +0000

Engineer — Act: A public working exploit now lets any domain user abuse ADCS to obtain a DC certificate and DCSync the krbtgt hash — full domain compromise from low privilege. Immediately audit certificate templates in ADCS for enrollment rights that allow non-admin principals, and restrict or disable any template that can issue DC computer certificates to ordinary users.
SOC/IR — Act: Working exploit means this attack path is now within reach of any authenticated user; hunt for ADCS certificate requests from non-computer, non-privileged accounts targeting DC-class templates, and sweep SIEM/EDR for DCSync (DS-Replication-Get-Changes-All) events originating from unexpected principals since July 24.
Leader — Plan: No confirmed in-the-wild exploitation yet, but a public PoC dropping a full domain-compromise chain from a low-privilege user is a credible near-term crisis. Ensure your AD/identity team has a remediation task in flight this week, and prepare a brief in case this escalates to customer or board questions the way ADCS misconfigurations have in the past.

Mon, 13 Jul 2026 13:18:50 +0000

Engineer — Learn: No vulnerability to patch here — this is a reconnaissance TTP story showing adversaries using AI-generated scripts for AD discovery. Useful context for understanding how attacker tooling is evolving, but no configuration or software change required today.
SOC/IR — Plan: The enumeration pattern — PowerShell querying DC, mapping users/computers/domains, exporting results to a directory, and generating AD_Report.html — is a detectable behavior signature; review PowerShell Script Block Logging coverage and build or tune a Sigma/KQL rule for this AD bulk-export pattern this quarter.
Leader — Learn: Demonstrates that AI tooling is lowering the skill floor for AD reconnaissance, a useful data point for board-level narratives about AI accelerating attacker capability; no immediate leadership action required.