Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 for CVE-2026-54121, an Active Directory Certificate Services (AD CS) flaw they’ve codenamed Certighost. It lets a low-privileged domain user obtain a certificate identifying them as a Domain Controller, then use that certificate to authenticate as the DC itself and pull the krbtgt secret via DCSync — full domain compromise starting from a single unprivileged account. Microsoft patched the underlying issue in its July 14 security updates and rated it 8.8 (CVSS), but the public proof-of-concept released today gives defenders who deferred patching a much shorter runway.

What’s broken

AD CS supports a certificate enrollment fallback called a “chase” during directory-object resolution. When a certificate request references an object the Certification Authority (CA) can’t immediately resolve locally, the CA falls back to querying elsewhere for identity data before it will issue the cert. Certighost abuses that fallback: an attacker submits a certificate request as a computer account they control, embedding two custom attributes — cdc, pointing at an attacker-controlled host, and rmd, carrying the DNS name of the target Domain Controller.

The CA follows the cdc attribute and queries the attacker’s host for identity data belonging to the named DC. The exploit stands up rogue SMB/LSA and LDAP listeners to answer that query, validating the CA’s Netlogon handshake against the real DC in the process so the CA’s checks pass, then hands back the target DC’s identity information as if it had come from a legitimate source. The CA, now holding attacker-supplied data it believes describes the DC, issues a valid certificate binding that DC’s identity to the attacker’s computer account.

From there the attack is mechanical: the attacker runs PKINIT against KDC using the freshly issued certificate, which returns a TGT and NT hash for the impersonated Domain Controller. Because DC machine accounts hold directory replication rights by default, that credential is sufficient to run DCSync and extract every secret in the domain, including krbtgt — the key that underwrites Golden Ticket persistence.

Requirements

Exploitation needs:

  • Network reachability from the attacker’s host to the CA, and from the CA back to the attacker’s rogue listeners
  • A domain account with rights to create a computer account (the default ms-DS-MachineAccountQuota of 10 is enough) or reuse of one already controlled
  • An Enterprise CA reachable for enrollment that follows the vulnerable chase path, with the default Machine template enabled

No administrator rights and no user interaction are required — this is a network-reachable, low-privilege-to-domain-admin chain, which is why Microsoft classed it as improper authorization (CWE-285) rather than a simple logic bug.

Impact

Any AD environment with a reachable Enterprise CA and standard enrollment defaults is exposed. This is squarely in the same family as prior AD CS escalation paths (ESC1-ESC8) that turned certificate services into a domain-admin shortcut, except Certighost doesn’t need a misconfigured template — it abuses a resolution fallback in the CA’s own enrollment logic. Organizations running AD CS as part of their PKI for VPN, Wi-Fi, smart-card, or code-signing authentication are all in scope if the CA role is exposed to standard domain users, which is the common deployment.

Mitigation

  • Patch CA servers now. Microsoft’s July 14 update adds CRequestInstance::_ValidateChaseTargetIsDC to certpdef.dll, which rejects IP literals, overlong names, and LDAP metacharacters in chase-related attributes, and requires the resolved AD computer object’s DNS name to match the target with userAccountControl including SERVER_TRUST_ACCOUNT. If you haven’t deployed July’s Patch Tuesday rollup, treat every Enterprise CA as unpatched-critical.
  • Audit CA server logs for certificate requests submitted under computer accounts with unusual cdc/rmd attribute values, and for CA-initiated outbound LDAP/SMB connections to unexpected hosts.
  • Restrict who can enroll against templates that issue authentication-capable certificates, and lower ms-DS-MachineAccountQuota to 0 where computer-account self-service isn’t needed.
  • Monitor for DCSync-pattern replication requests from accounts that aren’t your actual Domain Controllers.

References