Published on August 17, 2026
Certighost and the Privilege Hiding in Your Certificate Authority
Severity
High
Detail
A critical vulnerability in Microsoft Active Directory Certificate Services (AD CS), tracked as CVE-2026-54121 and dubbed Certighost, can allow a low-privileged Active Directory user to obtain a certificate that authenticates as a Domain Controller. Successful exploitation can ultimately lead to full Active Directory domain compromise.
Microsoft patched the vulnerability as part of its July 14, 2026 security updates. A working proof-of-concept (PoC) was subsequently released publicly on July 24, significantly lowering the barrier for exploitation and increasing the urgency for organizations operating Enterprise CAs.
The vulnerability exists in an AD CS certificate-enrollment fallback mechanism known as “chase” functionality. The issue allows requester-controlled information to influence where the CA retrieves directory information without adequately validating that the destination is a legitimate Domain Controller..
How?
Certighost requires an attacker to have a valid domain account and network access, but does not require administrator privileges or user interaction.
The attack abuses the AD CS enrollment process through the cdc and rmd attributes. When the CA cannot immediately resolve the requested object, it can follow the requester-provided cdc value to another system to obtain directory information.
The vulnerability occurs because the CA does not sufficiently verify that the supplied endpoint is actually a legitimate Domain Controller before trusting the information returned by that system. An attacker can therefore direct the CA toward infrastructure under their control and provide forged identity information representing a real Domain Controller.
The attack chain can be summarized as:
- The attacker obtains or controls a low-privileged domain account.
- The attacker uses a controlled machine account or creates one where the default ms-DS-MachineAccountQuota permits it.
- Rogue SMB and LDAP services are established on attacker-controlled infrastructure.
- The attacker manipulates the certificate enrollment request so that the CA performs a chase lookup against the rogue system.
- The rogue system provides identity information corresponding to a targeted Domain Controller.
- The CA accepts the returned information and issues a certificate containing the Domain Controller’s identity.
- The attacker uses the certificate through PKINIT to authenticate as the Domain Controller.
- Because Domain Controllers possess powerful directory replication privileges, the attacker can potentially perform DCSync and obtain sensitive Active Directory secrets, including the krbtgt hash.
- Control of krbtgt can subsequently enable Kerberos ticket forgery and potentially complete domain compromise.
The default Active Directory MachineAccountQuota setting can make the initial stage easier because ordinary domain users may be permitted to create computer accounts.
Successful exploitation can allow an attacker to move from a normal domain account to Domain Controller impersonation and potentially achieve complete Active Directory compromise.
Potential consequences include:
- Impersonation of a Domain Controller.
- Kerberos authentication using a Domain Controller identity.
- DCSync attacks against Active Directory.
- Extraction of sensitive credential material, including the krbtgt secret.
- Forgery of Kerberos authentication tickets.
- Privilege escalation from a low-privileged domain account to domain-level control.
- Compromise of systems, accounts, and services that trust the affected Active Directory domain.
The vulnerability is particularly significant because the initial foothold does not require administrative privileges. A standard authenticated domain user was sufficient in the researchers’ demonstrated attack chain under the affected configuration. Microsoft assigned CVSS 8.8 (High) to CVE-2026-54121 and classified it as an improper authorization vulnerability in AD CS.
Recommendation
Organizations should implement a layered security approach to reduce the risk of Certighost exploitation and Active Directory compromise:
- Apply the latest Microsoft security updates to affected AD CS servers and Domain Controllers.
- Review AD CS certificate templates and restrict certificate enrollment permissions to authorized users only.
- Monitor certificate issuance and investigate unusual certificates requested for Domain Controllers or privileged accounts.
- Restrict unnecessary MachineAccountQuota permissions and monitor for suspicious computer account creation.
- Monitor for unusual PKINIT/Kerberos authentication and DCSync activity that may indicate Domain Controller impersonation.
Source