Certighost AD CS Flaw Lets Users Impersonate Domain Controllers (CVE-2026-54121)

Security researchers H0j3n and Aniq Fakhrul have publicly released a working exploit, dubbed Certighost, that allows a low-privileged Active Directory user to obtain a certificate for a Domain Controller and authenticate as that machine. The vulnerability, tracked as CVE-2026-54121, resides in Active Directory Certificate Services (AD CS) and has been assigned a CVSS score of 8.8 by Microsoft, who classified it as an improper authorization flaw. Microsoft issued a patch on July 14, ten days before the public proof-of-concept dropped. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can be leveraged to perform a DCSync attack and extract the krbtgt secret, effectively handing attackers the keys to the entire domain.

Exploitation requires only network access and a standard domain account—no administrator rights or user interaction. In their tests, the researchers used a normal Domain Users account to create a computer object under the default ms-DS-MachineAccountQuota of 10, or reused one already under their control. The bug sits in an AD CS enrollment fallback known as a "chase." When a certification authority cannot obtain an end entity's information, the Windows enrollment protocol allows the request to supply cdc (the Active Directory server to contact) and rmd (the machine object to resolve). The CA followed the requester-supplied cdc host over SMB and LDAP without first verifying it was a legitimate Domain Controller, enabling the attackers to relay the CA's authentication challenge to the real DC over Netlogon and return the target's objectSid and dNSHostName.

The publicly released exploit automates the entire chain. It creates or reuses a computer account via the --computer-name flag, starts listeners on ports 445 and 389, relays the CA's challenge to the real Domain Controller over Netlogon, then submits the cdc and rmd attributes and writes a PFX file and Kerberos credential cache. The tool uses Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) to complete the authentication. Organizations running an Enterprise CA should immediately install Microsoft's July 14 updates on all AD CS hosts. Defenders can also use tools like our port scanner to audit exposure on SMB and LDAP, and the SSL/TLS checker to verify certificate infrastructure configurations across the environment.

As of the disclosure date, no primary source reviewed reported active exploitation in the wild, though the full proof-of-concept is now publicly available. The researchers also documented a lab-tested method to disable the chase fallback when immediate patching is not possible, though they caution it can break legitimate enrollment flows. Security teams should audit their AD CS configurations, review certificate templates, and monitor for anomalous enrollment requests that specify unusual cdc values. Admins can validate their broader attack surface with our privacy checkup to identify exposed services and misconfigurations that could compound the risk.