Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low‑privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine—an issue tracked as CVE-2026-54121 and assigned a CVSS score of 8.8.
How the Certighost chain gains domain‑controller identity
The flaw, codenamed "Certighost" by its authors, exploits an AD CS (Active Directory Certificate Services) enrollment fallback called a "chase." When a certification authority cannot obtain an end entity's information, the Windows enrollment protocol allows the request to supply cdc (the Active Directory server to contact) and rmd (the machine object to resolve). The researchers found the CA followed the requester‑supplied cdc host over SMB and LDAP without first proving the host was a genuine Domain Controller.
An attacker can run rogue LSA and LDAP services, relay the CA's authentication challenge to the real Domain Controller over Netlogon, and return the target Domain Controller's objectSid and dNSHostName. A controlled machine account supplies the valid domain identity the CA needs, the CA authenticates that account, and then signs the target Domain Controller's identity into the certificate. The chain uses PKINIT (Public Key Cryptography for Initial Authentication in Kerberos) so the resulting Kerberos credential can request account secrets via DCSync, including the krbtgt secret.
Exploit prerequisites, test environment, and observable behavior
Exploitation requires network access and a domain account only—no administrator rights or user interaction. In the researchers' tests a normal Domain Users account could create a computer account under the default ms-DS-MachineAccountQuota value of 10 or reuse a computer account it already controlled. The public exploit automates the sequence: it can create or reuse a computer account (an option exists as --computer-name), start listeners on ports 445 and 389, relay the CA's challenge to the real Domain Controller over Netlogon, submit the cdc and rmd attributes, and write out a PFX file and a Kerberos credential cache.
The researchers tested the exploit in a Windows Server 2016‑or‑later forest with an Enterprise CA, the default Machine certificate template, and the default machine‑account quota. The NVD entry further lists Windows Server 2012 through Windows Server 2025 (including Server Core editions) and Windows 10 versions 1607 and 1809 as affected.
Microsoft's patch and the technical hardening added
Microsoft patched the AD CS issue on July 14 after the researchers reported it on May 14 and Microsoft confirmed it on May 22. The vendor classified the vulnerability as improper authorization. Binary analysis by the researchers shows the July update adds CRequestInstance::_ValidateChaseTargetIsDC to certpdef.dll; the new validation rejects IP literals, overlong names, and LDAP metacharacters, requires exactly one matching Active Directory computer object whose DNS name matches the target and whose userAccountControl includes SERVER_TRUST_ACCOUNT (8192), and introduces a later SID comparison that blocks object substitution.
As of July 24 the flaw was not listed in CISA's Known Exploited Vulnerabilities catalog, and no primary source reviewed by The Hacker News reported exploitation in the wild. The researchers note, however, that the full proof‑of‑concept was public—an absence of reporting does not prove exploitation has not occurred.
Short‑term mitigation for administrators who cannot immediately patch
Administrators running an Enterprise CA were advised to install Microsoft's July 14 updates on AD CS hosts. Where immediate patching is not possible, the researchers documented a lab‑tested way to disable the chase fallback, though they warned it can break legitimate enrollment flows. The commands shown by the researchers to clear the chase flag and restart Certificate Services are:
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC Restart-Service CertSvc -Force
The researchers recommend staging that mitigation first and treating the July update as the permanent fix.
What this means for Enterprise CA operators, security teams, and incident responders
- Enterprise CA operators should prioritize installing the July 14 AD CS updates and verify CA configuration and enrollment templates—especially any Enterprise CA that follows the vulnerable chase path and exposes enrollment over SMB/LDAP to internal network segments.
- Security teams and incident responders should look for anomalous certificate issuance where a certificate's subject corresponds to a Domain Controller but was requested from a low‑privileged account, review machine‑account creation and reuse events (ms‑DS‑MachineAccountQuota activity), and monitor for new Kerberos credentials associated with Domain Controller identities and DCSync activity targeting account secrets such as krbtgt.
- Procurement and IT change teams should be aware that disabling chase behavior can disrupt legitimate enrollment and must be staged and tested before deployment.
Certighost is a reminder that protocol fallbacks and remote service discovery can be exploited when authentication or identity checks are incomplete. The July 14 patch adds explicit validation to the chase path, but the public proof‑of‑concept and the limited mitigations available mean organizations with Enterprise CAs must move quickly to patch, stage any temporary changes carefully, and hunt for the specific signs the researchers described.
