Certighost CVE-2026-54121: New AD CS Flaw Let Low-Priv Users Impersonate Domain Controllers

A newly disclosed Active Directory Certificate Services vulnerability, tracked as CVE-2026-54121 and dubbed “Certighost,” allowed a low-privilege domain user to trick a Certification Authority into issuing a certificate that impersonated a Domain Controller, opening a path to full domain compromise.

Researchers @h0j3n and @aniqfakhrul published the technical write-up and proof-of-concept on July 24, 2026, following Microsoft’s patch a week earlier on July 14, 2026.

AD CS issues X.509 certificates that bind a public key to an identity, which clients then present to the Kerberos Key Distribution Center for authentication. Certificate templates govern who can enroll and what identity data the CA will accept in a request, and this template-controlled trust boundary is exactly what Certighost violated.

New AD CS Flaw

The bug lived in an enrollment fallback called a “chase,” used during cross-domain-controller certificate requests when the CA needs to resolve a requester’s identity across domains.

Two attacker-influenced attributes, cdc (Client DC) and rmd (Remote Domain), told the CA which host to contact and which principal to look up, and the CA followed these values without first confirming the target was a genuine Domain Controller.

By standing up rogue SMB, LSA, and LDAP services on an attacker-controlled host and abusing the default ms-DS-MachineAccountQuota setting, an attacker could feed the CA fabricated identity data, including a real DC’s objectSid and dNSHostName, which then got baked into the issued certificate’s strong-mapping fields.

Security firm SentinelOne classified the root cause as improper authorization (CWE-285), noting that “AD CS fails to properly validate whether an authenticated requester is entitled to the operation being performed”.

“Certighost is a reminder that AD CS bugs rarely come from broken cryptography they come from a CA trusting a network response it never should have trusted in the first place. The chase fallback worked exactly as designed; nobody had asked whether the design itself was safe.”]

Once issued, the forged certificate let the attacker authenticate to Kerberos as the impersonated Domain Controller and obtain a valid TGT. Because Domain Controller accounts hold directory replication rights, the attacker could then run a DCSync attack to extract the krbtgt account’s secret, a step that effectively hands over the keys to the entire domain.

The July 2026 update introduces a new function, CRequestInstance::_ValidateChaseTargetIsDC, gated behind a servicing flag identified as Feature_3185813818, which queries Active Directory to confirm the cdc hostname actually maps to a computer object with the SERVER_TRUST_ACCOUNT bit set before the chase is allowed to continue.

A follow-on SID comparison was also added so the object resolved through the chase must match the expected identity, closing the substitution gap entirely.

Mitigation

Organizations unable to deploy the update immediately can disable the vulnerable fallback outright by clearing the EDITF_ENABLECHASECLIENTDC flag via certutil and restarting the Certificate Services, though this is a stopgap that can silently regress if the flag is re-enabled through policy or imaging.

Security teams following the disclosure noted that active exploitation attempts tied to related AD CS authentication bypass techniques were already being tracked days before the public writeup, underscoring the urgency of patching every issuing CA rather than relying solely on the registry workaround.