Security researchers have identified a critical vulnerability in Active Directory Certificate Services (AD CS), dubbed ‘Certighost,’ which enables low-privileged Active Directory users to impersonate domain controllers. This flaw, tracked as CVE-2026-54121, has been assigned a CVSS score of 8.8, indicating its high severity.
The exploit leverages a weakness in the AD CS enrollment process, specifically within the ‘chase’ fallback mechanism. When a certification authority (CA) cannot retrieve an end entity’s information, the Windows enrollment protocol allows the request to specify a ‘cdc’ (Active Directory server to contact) and ‘rmd’ (machine object to resolve). The vulnerability arises because the CA follows the requester-supplied ‘cdc’ host over Server Message Block (SMB) and Lightweight Directory Access Protocol (LDAP) without verifying its authenticity as a legitimate domain controller.
By exploiting this flaw, an attacker can operate rogue Local Security Authority (LSA) and LDAP services, relay the CA’s authentication challenge to the actual domain controller via ‘Netlogon,’ and return the target domain controller’s ‘objectSid’ and ‘dNSHostName.’ Utilizing a controlled machine account, the attacker provides the valid domain identity required for the CA to proceed, ultimately resulting in the CA signing the target domain controller’s identity into a certificate.
Once authenticated as the target domain controller, the attacker can request account secrets through ‘DCSync,’ including the ‘krbtgt’ secret. This access effectively grants the attacker the ability to replicate directory data, posing a significant security risk to the organization.
Exploitation of this vulnerability requires network access and a domain account but does not necessitate administrative privileges or user interaction. In practical terms, a standard ‘Domain Users’ account can create a computer account under the default ‘ms-DS-MachineAccountQuota’ value of 10 or reuse an existing controlled account. The attack chain also necessitates an Enterprise CA that follows the vulnerable chain path, enrollment through the default Machine template, and network reachability from the CA to the attacker’s SMB and LDAP listeners.
Microsoft addressed this issue in their July 14 updates for AD CS hosts. Organizations operating an Enterprise CA are strongly advised to apply these updates promptly to mitigate the risk associated with this vulnerability. As of July 24, there have been no confirmed reports of exploitation in the wild; however, the availability of a full proof-of-concept increases the likelihood of potential attacks.
For organizations unable to apply the patch immediately, the researchers have documented a lab-tested method to disable the chase fallback. While this workaround can prevent exploitation, it may disrupt legitimate enrollment processes, so it should be implemented with caution.
This vulnerability underscores the critical importance of securing certificate services within Active Directory environments. Organizations should not only apply the necessary patches but also review and strengthen their certificate enrollment processes to prevent similar vulnerabilities from being exploited in the future.
