Certighost (CVE-2026-54121): any AD account can impersonate a Domain Controller

CVE-2026-54121, CVSS 8.8. A domain account with no privileges is sufficient to obtain an AD CS-signed certificate for the identity of a Domain Controller, then authenticate via PKINIT and extract krbtgt via DCSync. Patched on July 14, 2026, public exploit since today.

The facts

Researchers H0j3n and Aniq Fakhrul publish on July 24, 2026 the complete mechanics of Certighost - CVE-2026-54121, CVSS 8.8 - a forest-wide Active Directory privilege escalation that exploits a fallback path in the Active Directory Certificate Services (AD CS) enrollment protocol.

Official timeline:

• May 14, 2026 - Report to Microsoft (MSRC).
• May 22, 2026 - Microsoft confirms the vulnerability.
• July 14, 2026 - Patch delivered in the Patch Tuesday.
• July 24, 2026 - Technical publication + functional exploit.

Affected systems: Windows Server 2012 to 2025, Windows 10 versions 1607 and 1809. In other words: almost all of the AD CS fleet deployed today.

Analysis - the "chase" mechanism

AD CS enrollment allows a machine to request a certificate for its own objectSid and dNSHostName. When the CA (Certificate Authority) does not have the necessary end-entity information, it uses an internal fallback called "chase" in the Microsoft code. This fallback allows the requester to specify:

• cdc - the host of the Domain Controller to query,
• rmd - the machine object to resolve.

The vulnerability lies in one line: the CA followed the cdc provided by the requester via SMB and LDAP without first verifying that it was a real Domain Controller. In other words, it accepted to communicate with any reachable host as if it were authoritative.

Attack chain

A domain user, without admin privileges, proceeds as follows:

1. They create (or reuse) a computer account - in a default tenant, ms-DS-MachineAccountQuota = 10 allows any user to create up to ten machines.
2. They launch rogue LSA and LDAP services on their machine, reachable by the CA.
3. They trigger an enrollment request with cdc pointing to their own host.
4. The CA connects to their SMB service, relays the authentication challenge to the real DC via Netlogon, and the attacker returns the objectSid + dNSHostName of the target DC.
5. The CA issues a certificate signed for the identity of the target Domain Controller.
6. The attacker authenticates via PKINIT with this certificate - they are now the DC in the eyes of the domain.
7. DCSync: they extract the krbtgt key. Game over.

Prerequisites: network access to the CA from the attacker's SMB/LDAP listeners, a valid domain account, an enterprise CA with the vulnerable chase path, default Machine template enabled for enrollment.

Who is impacted

• Any AD forest with AD CS deployed and a Machine template (or equivalent) accessible to authenticated users - which remains the default configuration in a huge number of tenants.
• Internal vector: only triggers with a valid domain account, but with no elevated privileges.
• Final target: complete domain compromise via krbtgt.

The Microsoft fix

The July patch adds the routine CRequestInstance::_ValidateChaseTargetIsDC, which rejects:

• IP literals in cdc,
• names that are abnormally long or contain LDAP metacharacters,
• and requires an exact match on an Active Directory computer object with the SERVER_TRUST_ACCOUNT flag and verification of its SID.

In other words: the CA no longer trusts what the client says, it verifies that it is indeed talking to a legitimate DC registered in AD.

What to do now

1. Apply the July 2026 Patch Tuesday on all your AD CS servers. This is the only real answer.
2. In the meantime, workaround lab-tested only, not to deploy in production without validation:

   certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
   Restart-Service CertSvc -Force

   This key disables the chase behavior on the CA side. Check the impact on your legacy enrollment flows before.

3. Reduce ms-DS-MachineAccountQuota to 0 for standard users - good general practice, independently of Certighost.
4. Monitor your CA logs (EventID 4886/4887 in Windows Security) for any unusual enrollment request on the Machine template.

What to do now - the essentials

July 2026 Patch Tuesday + reduction of MachineAccountQuota to 0. The PoC is public, the window for opportunistic exploitation is now open.

Certighost joins the family of AD CS post-Certipy attacks (ESC1 to ESC15) that make Windows PKI infrastructure one of the most reliable escalation paths on a poorly hardened domain. The message has not changed since SpecterOps: audit your AD CS templates.