A critical vulnerability in Microsoft’s Active Directory Certificate Services (AD CS), known as CertiGhosT and tracked as CVE-2026-54121, has been identified, allowing low-privileged domain users to impersonate Domain Controllers and potentially take over entire Active Directory domains. This flaw was addressed in Microsoft’s July 2026 security updates following responsible disclosure earlier this year.
AD CS serves as Microsoft’s public key infrastructure (PKI) system, issuing X.509 certificates utilized for encryption, signing, and authentication within a domain. These certificates function as digital identification, with a Certification Authority (CA) signing them to bind a public key to an identity that other services can trust. A notable application is certificate-based Kerberos authentication (PKINIT), where a client requests a certificate and later presents it to the Key Distribution Center (KDC) to obtain a Kerberos ticket. The KDC maps the certificate’s identity data to an Active Directory account—a process that the CertiGhosT vulnerability compromises.
In specific enrollment scenarios, the CA performs a secondary directory lookup, known as a chase, controlled by two request attributes:
cdc(Client DC): Specifies the host the CA should contact.rmd(Remote Domain): Specifies the principal to look up.
The vulnerable CA code trusted the host specified in cdc without verifying its authenticity as an actual Domain Controller. This oversight allowed attackers to set up rogue SMB, LDAP, and LSA services on their own machines, direct the CA to these services via cdc, and return fabricated identity data, including a legitimate Domain Controller’s Security Identifier (SID) and DNS hostname for the rmd target.
By leveraging the default ms-DS-MachineAccountQuota setting—which permits any user to register up to 10 machine accounts—an attacker’s rogue host could pass the CA’s authentication checks as a valid domain principal, despite not being the Domain Controller it claimed to be. Once the CA issued a certificate containing the impersonated Domain Controller’s identity data, the attacker could authenticate as that Domain Controller.
Since Domain Controllers possess directory replication rights, this access enabled a DCSync attack, allowing the extraction of sensitive secrets, including the krbtgt account hash, effectively granting full control over the domain.
To mitigate this vulnerability, Microsoft’s July 2026 patch introduces a new validation function, _ValidateChaseTargetIsDC, controlled by a servicing flag (Feature_3185813818). Before the CA follows a cdc target, it now:
- Rejects empty, oversized, or IP-literal hostnames.
- Blocks LDAP injection characters.
- Queries Active Directory to confirm the target is a legitimate computer object with the
SERVER_TRUST_ACCOUNTflag (value 8192). - Performs a follow-up SID comparison to prevent object substitution.
Only after these checks pass does the CA proceed with the chase and certificate issuance.
For organizations unable to deploy the July update immediately, a temporary mitigation involves disabling the vulnerable chase fallback by executing the following commands:
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC Restart-Service CertSvc -Force
It’s important to note that this is a temporary measure, not a permanent fix. If the flag is re-enabled later, the vulnerability remains exploitable.
This development underscores the critical importance of promptly applying security patches and maintaining vigilant monitoring of Active Directory configurations. Organizations should assess their AD CS setups to ensure that default settings do not inadvertently grant excessive privileges, thereby reducing the risk of similar vulnerabilities being exploited in the future.
