A newly disclosed Active Directory Certificate Services (AD CS) vulnerability, dubbed Certighost, allowed a low-privilege domain user to impersonate a Domain Controller and take over an entire Active Directory domain.
Tracked as CVE-2026-54121, the flaw was patched in Microsoft’s July 2026 security updates following responsible disclosure earlier this year.
AD CS is Microsoft’s public key infrastructure (PKI) system, issuing X.509 certificates used for encryption, signing, and authentication across a domain. Certificates act like digital ID cards: a Certification Authority (CA) signs them, binding a public key to an identity that other services can trust.
One key use case is certificate-based Kerberos authentication (PKINIT), where a client requests a certificate and later presents it to the Key Distribution Center (KDC) to obtain a Kerberos ticket. The KDC maps the certificate’s identity data to an AD account — and this mapping process is exactly where Certighost breaks down.
During certain enrollment scenarios, the CA performs a secondary directory lookup called a chase, controlled by two request attributes:
cdc(Client DC) — specifies the host the CA should contactrmd(Remote Domain) — specifies the principal to look up
The vulnerable CA code trusted whatever host was supplied in cdc without verifying it was an actual Domain Controller, reads the advisory.
An attacker could stand up rogue SMB, LDAP, and LSA services on their own machine, point the CA at it via cdc, and return fabricated identity data including a real DC’s SID and DNS hostname for the rmd target.
Combined with a machine account created through the default ms-DS-MachineAccountQuota setting (which lets any user register up to 10 machine accounts), an attacker’s rogue host could pass the CA’s authentication checks as a “valid” domain principal, even though it wasn’t the DC it claimed to be.
Once the CA issued a certificate carrying the impersonated DC’s identity data, the attacker could authenticate as that Domain Controller.
Since DCs hold directory replication rights, this access enabled a DCSync attack extracting sensitive secrets including the krbtgt account hash, effectively handing over full domain control.
Microsoft’s July 2026 patch introduces a new validation function, _ValidateChaseTargetIsDC, gated behind a servicing flag (Feature_3185813818). Before the CA follows a cdc target, it now:
- Rejects empty, oversized, or IP-literal hostnames
- Blocks LDAP injection characters
- Queries AD to confirm the target is a real computer object with the
SERVER_TRUST_ACCOUNTflag (value 8192) - Performs a follow-up SID comparison to prevent object substitution
Only after these checks pass does the CA proceed with the chase and certificate issuance.
Organizations unable to deploy the July update right away can disable the vulnerable chase fallback with:
textcertutil -setreg policyEditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -ForceThis is a temporary mitigation, not a fix — if the flag is re-enabled later (via policy, imaging, or an admin action), the CA becomes exploitable again. Test this in staging first, since any legitimate workflows relying on the chase fallback will break.
A proof-of-concept is available on GitHub. Organizations running AD CS should prioritize patching immediately and audit EDITF_ENABLECHASECLIENTDC settings across all Enterprise CAs.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
