Certighost: The Attack That Steals Domain Controller Identity via AD CS

Introduction

On July 24, 2026, researchers H0j3n and Aniq Fakhrul published a working exploit, dubbed Certighost, that targets Microsoft’s Active Directory Certificate Services (AD CS). The code exploits CVE-2026-54121, an improper authorization flaw with a CVSS score of 8.8 (High), capable of allowing a low‑privileged domain user to obtain a valid certificate for a Domain Controller. From that moment, compromise of the entire Active Directory forest is only a matter of time.

The flaw was reported by Microsoft on May 14, confirmed on May 22, and fixed with the July 14, 2026 updates. The release of the proof‑of‑concept, just ten days after the patch, now exponentially increases the risk for all organizations that have not yet applied the fixes.

Technical Analysis

The vulnerability lies in the chase fallback mechanism used by an enterprise Certification Authority (CA) when it cannot independently resolve an object’s identity. Under normal conditions, the CA queries the Domain Controller for information about the requester and decides whether to issue the certificate. An attacker can, however, set up a fake Domain Controller, causing the CA to contact their malicious services exposed on SMB (445) and LDAP (389) ports.

The following are sufficient to carry out the attack:

• a low-privileged domain account,
• the ability to create a computer account (the default ms-DS-MachineAccountQuota is 10) or to reuse one already under control,
• an enterprise CA that uses the default Machine template.

The exploit automates the entire chain: it creates or reuses a computer account, starts SMB and LDAP listeners to impersonate a Domain Controller, intercepts the authentication request coming from the CA, and forwards it to the real Domain Controller via the Netlogon protocol. In this way, the authentication challenge is correctly satisfied, but the attacker inserts manipulated attributes (cdc and rmd) into the certificate request. At the end of the process, the CA issues a PFX certificate that matches the identity of a legitimate Domain Controller.

With the certificate in hand, the attacker performs Kerberos authentication via PKINIT and obtains a credential cache for the target Domain Controller. At this point, they can exploit replication privileges to launch a DCSync attack and extract the krbtgt secret, the cryptographic material that protects the entire domain.

The patch released by Microsoft on July 14 (applicable to Windows Server 2012–2025 and Server Core editions, as well as Windows 10 versions 1607 and 1809) targets the function CRequestInstance::_ValidateChaseTargetIsDC in the certpdef.dll library. It blocks literal IP addresses, overlong names, and LDAP metacharacters, and verifies that the computer object contacted by the CA is indeed a Domain Controller by checking the SERVER_TRUST_ACCOUNT flag (8192) and SID matching.

Impact

The compromise grants a low‑privileged user full control of the domain. Once the krbtgt hash is obtained via DCSync, the attacker can forge Golden Tickets – Kerberos tickets that grant unlimited and persistent access to any domain resource, including the ability to move laterally to other trusted domains.

As of the PoC’s publication (July 24, 2026), Microsoft had not observed active exploitation in the wild, but had already detected testing activity related to the flaw. The public availability of the Certighost exploit drastically increases the likelihood of real attacks, especially in environments where patches have not yet been deployed.

Mitigation

The definitive solution is to immediately apply the security updates released by Microsoft on July 14, 2026, to all servers hosting the Certification Authority role. For organizations that cannot immediately deploy the update, Microsoft provides a temporary workaround that disables the chase mechanism:

certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force

Warning: this configuration may break legitimate enrollment workflows; it is recommended to test it in a lab before production deployment and to proceed with the patch as soon as possible.

In parallel, it is essential to enable monitoring:

• Enable Certificate auditing (success and failure) on AD CS servers.
• Monitor security event IDs 4886 and 4887, which log suspicious certificate requests and issuance for unexpected Domain Controller identities.
• Microsoft Defender generates dedicated alerts such as Potential Certighost (CVE-2026-54121) AD CS abuse and Active Directory Certificate Services attack tool activity. Generic signals (LDAP reconnaissance, anomalous Kerberos tickets, DCSync attempts) may also accompany an attack but are not specific.
• Reducing the default computer account quota (ms-DS-MachineAccountQuota) can limit the attacker’s ability to create new objects, but does not prevent reuse of already compromised accounts.

FAQ

1. What is CVE-2026-54121 and why is it so dangerous?
CVE-2026-54121 is an improper authorization vulnerability in Microsoft Active Directory Certificate Services (AD CS). It allows a low-privileged domain user to obtain a certificate for a Domain Controller and, from there, escalate to full domain control by leveraging attacks such as DCSync and Golden Ticket.

2. How can I check if my infrastructure is vulnerable?
If your organization uses an enterprise Certification Authority with the default Machine template and the chase mechanism enabled, and you have not yet applied the July 14, 2026 updates, the system is at risk. You can check for the presence of the AD CS role and the operating system version: all editions from Windows Server 2012 to 2025 are affected. The availability of the public PoC makes verification even more urgent.

3. What can I do if I cannot install the patch right away?
You can apply the workaround that disables chase via the command certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC (test it as it may block legitimate issuance). At the same time, strengthen certificate event monitoring and alert the security team about any suspicious requests for Domain Controllers. The patch remains the only complete protection and should be scheduled with the highest priority.