Certighost Active Directory CS Exploit Allows Low-Privileged Users to Compromise Domain

Key Takeaways

• A critical vulnerability, dubbed Certighost, in Active Directory Certificate Services (AD CS) allowed unprivileged domain users to completely compromise an Active Directory domain.
• The flaw, tracked as CVE-2026-54121, enabled attackers to impersonate a Domain Controller.
• Microsoft addressed Certighost in its July 2026 security updates.
• Immediate patching is strongly recommended for all organizations utilizing AD CS.

Unprivileged Users Could Seize Active Directory Domains via Certighost Flaw

A severe vulnerability within Microsoft’s Active Directory Certificate Services (AD CS), now named Certighost, granted low-privileged domain users the ability to masquerade as a Domain Controller and achieve full control over an entire Active Directory domain. This critical flaw was identified as CVE-2026-54121.

Following responsible disclosure earlier this year, Microsoft released patches for this vulnerability as part of its July 2026 security updates.

Understanding Active Directory Certificate Services (AD CS)

AD CS functions as Microsoft’s public key infrastructure (PKI) system, responsible for issuing X.509 certificates. These digital certificates are fundamental for encryption, digital signing, and authentication processes throughout a domain. They operate similarly to digital identity cards, where a Certification Authority (CA) signs them, thereby linking a public key to an identity that other services can then trust.

A significant application of AD CS is certificate-based Kerberos authentication, known as PKINIT. In this scenario, a client first requests a certificate and subsequently presents it to the Key Distribution Center (KDC) to obtain a Kerberos ticket. The KDC’s role is to map the identity data contained within the certificate to an Active Directory account. It is precisely this identity mapping mechanism where the Certighost vulnerability exploited a critical weakness.

The Mechanics of the Certighost Exploit

During specific certificate enrollment procedures, the Certificate Authority (CA) initiates a secondary directory lookup process, referred to as a “chase.” This process is governed by two crucial request attributes:

• cdc (Client DC): Specifies the hostname of the Domain Controller that the CA should contact.
• rmd (Remote Domain): Defines the principal whose identity needs to be looked up.

According to the advisory, the vulnerable CA code inherently trusted the hostname provided in the cdc attribute without performing adequate validation to confirm it was indeed a legitimate Domain Controller.

Attackers leveraged this trust by setting up their own malicious SMB, LDAP, and LSA services on a machine they controlled. They would then direct the CA to this rogue host via the cdc attribute. The attacker’s services would then return fabricated identity data, including the Security Identifier (SID) and DNS hostname of a real Domain Controller, for the rmd target.

Coupled with the ability to create machine accounts—a default setting (ms-DS-MachineAccountQuota) allowing any authenticated user to register up to 10 machine accounts—the attacker’s rogue host could bypass the CA’s authentication checks. It would appear as a “valid” domain principal, despite not being the Domain Controller it purported to be. Once the CA issued a certificate containing the impersonated Domain Controller’s identity, the attacker could then authenticate as that Domain Controller.

This level of access, impersonating a Domain Controller, grants directory replication rights. This enabled attackers to execute a DCSync attack, a technique for extracting sensitive secrets such as the krbtgt account hash. Obtaining this hash effectively provides full administrative control over the entire Active Directory domain.

Microsoft’s Patch and Enhanced Validation

Microsoft’s July 2026 security update introduced a new validation function, _ValidateChaseTargetIsDC, activated by a servicing flag (Feature_3185813818). Before the CA attempts to connect to a cdc target, it now performs a series of rigorous checks:

• Rejects hostnames that are empty, excessively long, or literal IP addresses.
• Blocks characters commonly used in LDAP injection attacks.
• Queries Active Directory to verify that the target is a legitimate computer object possessing the SERVER_TRUST_ACCOUNT flag (value 8192).
• Conducts a subsequent SID comparison to prevent object substitution.

The CA will only proceed with the chase and certificate issuance once all these validation steps are successfully completed.

What You Should Do

• Apply Updates Immediately: Prioritize the deployment of Microsoft’s July 2026 security updates across all systems running Active Directory Certificate Services (AD CS).
• Audit EDITF_ENABLECHASECLIENTDC: Review the status of the EDITF_ENABLECHASECLIENTDC setting on all Enterprise CAs to ensure it is correctly configured or disabled if not needed.
• Temporary Mitigation (If Patching is Delayed): If immediate patching is not feasible, temporarily disable the vulnerable chase fallback using the following commands:

  certutil -setreg policyEditFlags -EDITF_ENABLECHASECLIENTDC
  Restart-Service CertSvc -Force

  This is a temporary measure and should be tested in a staging environment first, as it may disrupt legitimate workflows relying on the chase fallback. Re-enabling this flag at a later date will reintroduce the vulnerability.

• Review Proof-of-Concept (POC): A proof-of-concept for Certighost is available on GitHub. Security teams can use this for internal testing in isolated environments to verify their defenses.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.