"An authenticated attacker could manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via PKINIT," Microsoft explained.
CVE-2026-54121 and the July 2026 patch timeline
The vulnerability tracked as CVE-2026-54121 was reported to Microsoft on May 14, 2026, by security researchers H0j3n and Aniq Fakhrul. Microsoft issued a fix as part of the July 2026 Patch Tuesday security updates. The researchers publicly disclosed technical details and released a proof-of-concept exploit the week before this report, demonstrating a route to domain compromise in certain Active Directory Certificate Services (AD CS) configurations.
How the AD CS "chase" fallback and cdc/rmd attributes were abused
AD CS, Microsoft's public key infrastructure for Windows domains, uses certificate enrollment requests to issue tokens that a domain controller then exchanges for Kerberos credentials. Certighost targets a fallback mechanism AD CS uses during enrollment — a procedure the researchers call a "chase." That chase uses two request attributes: cdc (Client DC), which identifies the server the Certification Authority should contact, and rmd (Remote Domain), which identifies the account the CA should search for.
When both attributes are supplied, the CA connects to the server named in the cdc attribute and searches for the rmd account. Previously, the CA did not verify that the server supplied by an attacker via the cdc value was a legitimate domain controller. That absence of verification allowed an attacker to run rogue SMB, LSA, and LDAP services, point the CA at an attacker-controlled system, and return false directory information for a targeted machine account.
The attack chain demonstrated by H0j3n and Aniq Fakhrul
The researchers showed how a low-privileged domain user can turn that chase behavior into a full domain compromise. Under the default ms-DS-MachineAccountQuota configuration, a low-privileged user is permitted to create a machine account. "A machine account created through the default ms-DS-MachineAccountQuota setting is a valid domain principal," the researchers wrote — a principal the chase endpoint can present to the CA.
In the demonstration the attacker first creates a machine account, deploys rogue SMB/LSA/LDAP services on an attacker-controlled host, and then submits a certificate request that directs the CA to that host while targeting a domain controller account via the rmd value. Because the CA trusted the identity information returned by the attacker-controlled services, it issued a certificate that could be used to authenticate as the targeted domain controller using PKINIT. The released certighost.py proof-of-concept automates this sequence, authenticates through PKINIT as the targeted domain controller, saves resulting Kerberos credentials to a .ccache file, and extracts the account's NT hash.
The researchers went on to show the downstream impact: using the saved Kerberos credentials with Impacket's secretsdump tool, they performed a DCSync operation and retrieved the krbtgt account's credentials. "A Domain Controller account has directory replication rights. With the resulting Kerberos credential, the attacker can request account secrets, including the krbtgt secret," the report explains.
Microsoft's remediation and the temporary workaround
Microsoft's July update added validation to the chase process. The patched CA now verifies that the server specified in the cdc attribute maps to a legitimate domain controller in Active Directory and confirms that the identity returned by that server matches the expected account. That change closes the specific protocol trust failure exploited by the PoC.
For administrators who cannot immediately deploy the July security updates, the researchers published a temporary mitigation that disables the optional chase fallback. The commands they shared are:
- certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
- Restart-Service CertSvc -Force
The researchers stress this is a temporary mitigation only and "has not been fully tested in production environments." They advise that admins should prioritize installing the latest security updates as soon as possible.
What this means for security teams, enterprise admins, and adversaries
- Security teams and technologists: Audit AD CS configurations and confirm the July 2026 updates are applied to Certification Authorities. If patching is delayed, evaluate the operational impact of disabling the chase fallback using the provided certutil and service commands — acknowledging the researchers' caveat about production testing.
- Enterprise administrators and procurement leaders: Verify default ms-DS-MachineAccountQuota settings and review controls around machine-account creation. The exploit leverages a default allowance that permits low-privileged users to create machine accounts; organizations relying on defaults should reassess that posture.
- Adversaries and red teams: The certighost.py PoC shows the attack can be automated end-to-end to obtain Kerberos credentials, extract NT hashes, and perform DCSync. The public release raises the operational urgency for defenders to apply the new validation or employ the temporary mitigation.
Certighost exposes a narrow technical failure — a missing check in an AD CS fallback chase — that, in default configurations, can be escalated into full domain compromise. Microsoft has issued a fix; researchers have provided both a proof-of-concept exploit and a stopgap mitigation that they caution is not fully tested in production. The concrete next step the record points to is therefore straightforward: prioritize installation of the July 2026 security updates and, if necessary, test any temporary registry/service changes in a controlled environment before broad deployment.
