Cyber Threat Brief — July 25 2026
⚠️ This report is AI-generated. Always validate findings.
1. Certighost AD CS Domain Controller Impersonation — CVE-2026-54121
TL;DR: Public PoC dropped July 24 lets any low-privileged domain user trick AD CS into issuing a Domain Controller certificate via enrollment chase fallback — enabling DCSync and full domain compromise.
What’s New:
- Working exploit published July 24 by H0j3n and Aniq Fakhrul (github.com/aniqfakhrul/CVE-2026-54121)
- Abuses AD CS enrollment “chase” fallback: attacker supplies
cdcrequest attribute pointing to attacker-controlled host, CA queries it for DC identity data instead of real directory - CA issues DC certificate to unprivileged account → Kerberos auth as DC → DCSync extracts all domain password hashes including
krbtgt - CVSS 8.8, requires only network access and a domain account — no admin rights or user interaction
- Patched July 14 Patch Tuesday; unpatched environments now have public weaponization path
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
cdc attribute in certificate requests | Enrollment parameter | T1649 | AD CS audit logs (EID 4886/4887) | Hunt |
| DC certificate issued to non-DC account | Certificate anomaly | T1649 | AD CS (EID 4887), CertUtil logs | Alert |
| DCSync replication requests from non-DC | Replication abuse | T1003.006 | DC Security log (EID 4662 with Replicating Directory Changes) | Alert |
| LDAP referral chase to non-DC host | Network anomaly | T1557 | LDAP debug logs, network capture | Hunt |
| github.com/aniqfakhrul/CVE-2026-54121 | Public PoC | — | — | Awareness |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | DCSync Activity (EID 4662 with replication GUIDs) | Does not detect certificate-based DC impersonation pre-DCSync |
| Elastic | Active Directory Certificate Services Suspicious Certificate Request | No specific rule for cdc chase abuse |
| Sigma | win_security_dcsync_attack.yml | Covers DCSync but not the upstream certificate issuance anomaly |
Sources: The Hacker News · GitHub PoC · H0j3n writeup · Field Effect · CyberSecurityNews
2. OpenSSL HollowByte — Pre-Auth TLS Memory Exhaustion DoS (No CVE)
TL;DR: Okta red team discovered that a single 11-byte TLS handshake payload forces OpenSSL to pre-allocate up to 131 KB of heap memory that glibc never returns to the kernel — silently patched with no CVE, leaving scanner-dependent orgs blind.
What’s New:
- Disclosed by Okta red team (public writeup sec.okta.com); major coverage escalation July 24
- TLS handshake pre-allocates receive buffer based on 4-byte header length declaration — attacker declares large body, sends 11 bytes total, drops connection
- glibc holds freed chunks for reuse but varying declared sizes prevents reuse → heap fragmentation → resident set climbs; 1 GB server OOM-killed at 547 MB stranded
- On a 16 GB server, HollowByte locked 25% of system memory without breaching connection limits
- No CVE assigned — OpenSSL shipped fix as “hardening” in 4.0.1, backported to 3.6.3/3.5.7/3.4.6/3.0.21 with no advisory or changelog note
- Standard vulnerability scanners will NOT flag this without CVE tracking
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| OpenSSL < 4.0.1 / < 3.6.3 / < 3.5.7 / < 3.4.6 / < 3.0.21 | Version check | T1499.001 | Asset inventory | Patch |
| Rapid TLS connection bursts with incomplete handshakes from single IP/range | Traffic pattern | T1499.001 | Firewall/IDS flow logs | Alert |
| Sudden RSS/memory growth on TLS-terminating hosts without CPU spike | Host anomaly | T1499.001 | Host metrics (Prometheus, collectd, Sysmon) | Alert |
| Connection count at limit but low data throughput | Behavioral anomaly | T1499.001 | Load balancer metrics | Hunt |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No coverage — no CVE means no analytic story |
| Elastic | None | No coverage |
| Sigma | None | No community rule published |
Sources: Okta Security · BleepingComputer · The Hacker News · oss-security · SecurityWeek
Status Updates
- CVE-2026-50522 (SharePoint Server): CISA KEV federal deadline TODAY July 25. Active exploitation via BinaryFormatter deserialization at
/_trust/default.aspx. Machine key theft for long-term persistence. 4th actively exploited SharePoint CVE this month. Original brief. - CVE-2026-16232 (Check Point SmartConsole): CISA KEV federal deadline TODAY July 25. Auth bypass via application token. Zero-day exploitation against exposed Management environments. 5 attacker IPs published. Original brief.
- CVE-2026-6875 (ServiceNow AI Platform): Active exploitation ongoing since July 18. Second sandbox-escape gadget chain confirmed — orgs that blocked only the published technique remain vulnerable. Fortune 500 and critical infrastructure victims confirmed. Not yet on CISA KEV. Original brief.