CVE-2026-54121 — nicknamed "Certighost" by its discoverers — demonstrated that a single overlooked trust decision in an enterprise Certification Authority can let a low‑privileged domain user escalate to full domain compromise.
How CVE-2026-54121 (Certighost) works
At the center of Certighost is Active Directory Certificate Services (AD CS) and an enrollment behavior called "chase" functionality. When an Enterprise CA cannot resolve a requested target object locally, it can follow routing information supplied by the requester: a parameter called cdc. The defect is straightforward and stark: the CA did not verify that the endpoint named in cdc was actually a legitimate Domain Controller.
An attacker points cdc at a machine they control. The CA reaches out, receives forged identity data — specifically the Domain Controller’s object security identifier and DNS host name — and binds that returned identity into a signed X.509 certificate that claims Domain Controller identity. With that certificate the attacker uses PKINIT (Kerberos public-key authentication) to obtain a Ticket Granting Ticket (TGT) as the Domain Controller’s machine account.
Domain Controller accounts hold directory replication rights sufficient to run a DCSync operation and extract credential material, including the krbtgt account hash. With krbtgt an adversary can forge Kerberos tickets broadly, effectively owning the domain. In testing, a standard Domain User account was sufficient because default Active Directory settings — notably the default MachineAccountQuota that permits ordinary users to create machine accounts — provided the final pieces the chain required.
Microsoft's response and the public proof‑of‑concept
Microsoft issued a fix on July 14, 2026; the update introduces the destination validation that blocks the specific chase abuse and Microsoft rated the vulnerability 8.8 on the CVSS scale. A working proof‑of‑concept was published on July 24, 2026, and researchers warned that while no exploitation in the wild had been confirmed at disclosure, a public PoC dramatically lowers the bar for reproduction and rapid operational exploitation.
Researchers also documented a workaround that disables the vulnerable chase functionality. That workaround exists because chase supports legitimate enrollment workflows; turning it off can break those workflows, so the source recommends testing any temporary change before wide deployment.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogConcrete mitigations: shrink standing privilege and constrain the CA
- Patch first. Apply Microsoft’s July 14, 2026 update to every issuing Certification Authority to close the specific CVE.
- Reduce MachineAccountQuota. Setting the domain’s MachineAccountQuota to zero removes the default ability for ordinary users to create machine accounts, shrinking the attack surface for this class of technique. The source advises inventorying provisioning workflows and routing machine creation through delegated, controlled accounts because some tooling and legacy processes assume the default quota.
- Constrain CA connectivity. Restrict outbound SMB and LDAP from Certification Authorities so they can communicate only with approved, authorized Domain Controllers — directly undercutting the rogue‑endpoint step in the attack chain.
- Audit enrollment rights. Review Enterprise CA deployments, certificate templates, and who can request certificates. Enforce the question the CA failed to ask: does the requesting principal have any business holding the identity that the certificate represents?
- Improve detection. Monitor for anomalous machine account creation, unusual certificate enrollment activity, and DCSync operations. The source is clear: DCSync from anything other than a Domain Controller deserves immediate response, and CA enrollment events must be monitored rather than relying solely on endpoint telemetry.
What this means for technologists, procurement leaders, and administrators
Technologists and security teams should prioritize the July 14, 2026 patch, test the chase-disable workaround before applying it, and inventory any provisioning workflows that depend on the MachineAccountQuota default.
Procurement leaders and enterprise IT managers should expect follow‑up work: some provisioning and legacy tooling will need adjustment or delegation controls. The source recommends routing machine creation through controlled accounts rather than preserving a convenient default.
Certification Authority and directory administrators must treat the CA as a privileged identity that manufactures trust: constrain its network reach, audit enrollment templates and permissions, and add CA‑centric detection to the monitoring stack.
A final, durable lesson
Certighost is not merely a certificate bug; it is a symptom of misplaced trust and standing privilege. The immediate vulnerability was fixed by adding destination validation to chase lookups, but the underlying exposures — permissive machine account defaults, overbroad enrollment rights, and flat trust between the CA and the domain — remain unless organizations change defaults and practices. The defensible posture urged by the source is to treat identity as infrastructure and privilege as risk: reduce standing privilege, validate the identities your systems trust, and watch the places where identity decisions are made.
Len Noe, a Solutions Architect at BeyondTrust, published the analysis and BeyondTrust offers a complimentary Identity Security Risk Assessment to help organizations uncover these hidden exposures.
Original reporting: https://www.bleepingcomputer.com/news/security/certighost-and-the-privilege-hiding-in-your-certificate-authority/
