Let me paint you a picture. A regular employee with basic domain user privileges, no admin rights, no special access can walk away with a certificate that lets them impersonate your Domain Controller. Sounds impossible, right? Wrong.
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that does exactly that. They named it Certighost, and it is one of those vulnerabilities that makes you rethink everything you thought you knew about Active Directory security.
Microsoft patched this Active Directory Certificate Services vulnerability ten days earlier as CVE-2026-54121. The CVSS score of 8.8 tells you this is serious. But the real story is how elegantly simple the attack is and how devastating the consequences can be.
What Is the Active Directory Certificate Services Vulnerability?
At its heart, this Active Directory Certificate Services vulnerability is an improper authorization flaw. The bug lives in an enrollment fallback mechanism called a "chase." When a certification authority cannot get the information it needs about an end entity, the Windows enrollment protocol lets the request provide two things: cdc (the Active Directory server to contact) and rmd (the machine object to resolve).
The problem? The CA followed those instructions without first verifying that the cdc host was actually a real Domain Controller. It took the requester's word for it. And that trust was exactly what the researchers exploited.
Here is what makes this Active Directory Certificate Services vulnerability particularly dangerous: you do not need admin rights. You do not need user interaction. You just need network access and a domain account. A regular Domain Users account works perfectly fine.
How Does the Certighost Attack Actually Work?
Let me walk you through the chain. It is clever, and once you understand it, you will see why this Active Directory Certificate Services vulnerability had security teams scrambling.
The attacker starts by creating a computer account or reusing one they already control. Active Directory allows up to ten machine account creations by default, so this is not a barrier.
Next, they set up rogue listeners on ports 445 (SMB) and 389 (LDAP). Think of these as fake services waiting for the CA to talk to them.
When the attacker submits a certificate request with their controlled machine account, they tell the CA to chase the request to a cdc host that points to their rogue listener. The CA, trusting the instruction, reaches out over SMB and LDAP.
The attacker's rogue services relay the CA's authentication challenge to the real Domain Controller over Netlogon. They grab the Domain Controller's objectSid and dNSHostName, then feed that back to the CA. The CA, now convinced it is talking to a legitimate Domain Controller, signs the certificate with the Domain Controller's identity.
The attacker ends up with a PFX file and a Kerberos credential cache that lets them authenticate as the Domain Controller using PKINIT.
And once you are authenticated as a Domain Controller, you can request account secrets through DCSync. Including the krbtgt hash. Game over.
What Makes This Active Directory Certificate Services Vulnerability Unique?
The researchers' binary analysis of Microsoft's patch gives us a clear picture of what was broken. The July update adds a validation function called CRequestInstance::_ValidateChaseTargetIsDC to certpdef.dll. This happens before the CA follows a chase.
The new validation checks are straightforward: it rejects IP literals, overlong names, and LDAP metacharacters. It then requires exactly one matching Active Directory computer object whose DNS name matches the target and whose userAccountControl includes SERVER_TRUST_ACCOUNT. A later SID comparison blocks any object substitution.
In other words, Microsoft fixed the Active Directory Certificate Services vulnerability by ensuring the CA verifies that the target it is talking to is genuinely a Domain Controller before following any chase instructions. It seems obvious in hindsight, does not it?
What Versions Are Affected?
This Active Directory Certificate Services vulnerability affects a wide range of Windows versions. The NVD record lists Windows Server 2012 through Windows Server 2025, including Server Core editions. It also affects Windows 10 versions 1607 and 1809.
If you are running any of these with an Enterprise CA, you need to pay attention.
What Are the Prerequisites for Exploitation?
The researchers tested their exploit in a specific environment: Windows Server 2016 or later forest, an Enterprise CA, the default Machine certificate template, and the default machine-account quota of 10.
For the Active Directory Certificate Services vulnerability to be exploitable, the attack chain requires a few conditions:
- The CA must follow the vulnerable chase path
- The Enterprise CA must be running
- The default Machine template must be available for enrollment
- The attacker must have network reachability from the CA to their SMB and LDAP listeners
These are common configurations. That is what makes this Active Directory Certificate Services vulnerability so concerning, it targets default setups that many organizations have in place.
Has This Active Directory Certificate Services Vulnerability Been Exploited in the Wild?
As of July 24, no primary source reviewed by The Hacker News reported exploitation in the wild. But here is the thing: the full proof-of-concept is now public. And that absence of reporting does not prove that exploitation has not occurred.
The timeline is worth noting. The researchers reported the Active Directory Certificate Services vulnerability to Microsoft on May 14. Microsoft confirmed it on May 22 and released the patch on July 14. The researchers publicly disclosed their findings on July 24.
That is a ten-day window between patch availability and public proof-of-concept. Ten days for defenders to get ahead of the threat. Ten days for attackers to reverse-engineer the patch and figure out what was fixed.
What Should You Do Right Now?
If you are running an Enterprise CA, patch immediately. Install Microsoft's July 14 updates on all AD CS hosts. This Active Directory Certificate Services vulnerability is too easy to exploit and too damaging to ignore.
But I know patching is not always instant. If you cannot apply the update right away, the researchers documented a lab-tested mitigation.
You can disable the chase fallback by running:
certutil -setreg policy\EditFlags
-EDITF_ENABLECHASECLIENTDCThen restart Certificate Services:
Restart-Service CertSvc -ForceA couple of important warnings here. First, the researchers tested this mitigation only in a controlled lab environment. It can break legitimate enrollment flows.
Stage it in your test environment first. Second, treat this as a temporary workaround. The July update is the real fix.
The Bigger Picture
This Active Directory Certificate Services vulnerability is another reminder that certificate-based authentication is powerful but complex. The attack chain shows the way to exploit the trust relationships in Active Directory in case of incomplete validation.
What is especially interesting about the Certighost vulnerability is that it does not require elevated privileges. In the case of a properly configured but vulnerable network, the Certighost vulnerability can lead to a significant change of balance in Active Directory.
For defenders, the lesson is clear: AD CS needs the same level of scrutiny as any other critical infrastructure. The certificate services that enable secure authentication can also enable devastating attacks if left misconfigured or unpatched.
Wrapping It Up
The Certighost Active Directory Certificate Services vulnerability is the kind of flaw that keeps security professionals up at night. A regular domain user can escalate to Domain Controller privileges with a few simple steps. The attack is automated. The proof-of-concept is public.
Microsoft has patched it, but only you can ensure your environment is protected. Check your AD CS hosts, apply the July updates, and if you cannot patch yet, implement the mitigation carefully.
The researchers who found this Active Directory Certificate Services vulnerability did the right thing by disclosing responsibly. Now it is on us to do the right thing by fixing it before someone else decides to use it.
FAQ Section
What is the Certighost vulnerability?
Certighost is an Active Directory Certificate Services vulnerability (CVE-2026-54121) that allows a low-privileged domain user to obtain a certificate for a Domain Controller and authenticate as that machine. This may result in full domain compromise via DCSync attacks.
How does the Active Directory Certificate Services vulnerability exploit work?
The problem is in an enrollment fallback mechanism referred to as a "chase." The CA trusts the requester-specified cdc and rmd values without verifying whether they actually identify a valid Domain Controller. Attackers are able to relay the challenge from the CA and get it to issue a certificate for the Domain Controller.
What can an attacker do with this vulnerability?
This is because when an attacker uses this Active Directory Certificate Services vulnerability, he will be able to authenticate himself as the Domain Controller and from there use the DCSync function to get the krbtgt hash and other secrets.
Which versions of Windows are affected?
This vulnerability is present in Windows Server 2012 to Windows Server 2025 including Server Core editions, as well as in Windows 10 version 1607 and 1809. All environments running Enterprise CAs on these platforms can be considered vulnerable.
How can I protect myself from this vulnerability in Active Directory Certificate Services?
Install the patches provided by Microsoft on all servers with AD CS on July 14, 2026. Or use the certutil command to turn off the chase fallback mechanism if you cannot install the patches, but only after lab testing.
