www.it-connect.fr
Certighost (CVE-2026-54121): A Standard AD Account Is Enough to Impersonate a Domain Controller
Certighost is the name of a major security flaw discovered in Windows Server AD CS. By exploiting it from a standard user account, an attacker can go as far as compromising the Active Directory domain after tricking the certification authority. Here’s what we know about this vulnerability, for which exploit code has been published online.
Table of Contents
Certighost: from a standard account to the krbtgt secret
Researchers H0j3n and Aniq Fakhrul are behind the discovery of CVE-2026-54121, which they named Certighost. This flaw is found in Active Directory Certificate Services, or AD CS, the service used to create a certification authority on Windows Server. It has a CVSS score of 8.8 out of 10, according to Microsoft’s security bulletin. And yes, Microsoft already patched it on July 14, 2026, as part of its record Patch Tuesday with 570 vulnerabilities patched.
The issue lies in a certificate enrollment fallback mechanism known as chase. In certain enrollment scenarios involving multiple domain controllers, the certification authority performs a second lookup in the directory. Two attributes included in the request steer this lookup, as the researchers explain in their analysis:
cdc(Client DC) identifies the host the certification authority must contact.rmd(Remote Domain) identifies the principal it must resolve.
The problem is that the certification authority contacted the host provided by the requester, over SMB and LDAP, without first verifying that it was a real domain controller. You can probably see where this is going: the identity data returned by that host were accepted as if they came from a legitimate directory.
From there, the exploitation chain can be carried out. An attacker with a domain account creates a machine account, which the default value of ms-DS-MachineAccountQuota (set to 10) allows, then exposes their own LDAP services. The certification authority queries them and receives the objectSid and dNSHostName of the targeted domain controller in return, while the machine account provides the valid domain identity needed to continue processing. The result: a certificate signed by the authority, carrying the identity of the domain controller.
What comes next is classic for anyone used to attacking Active Directory environments. The certificate is used to authenticate via PKINIT, and since a domain controller account has directory replication rights, the attacker can then launch a DCSync attack and recover krbtgt. In practice, that means full domain compromise.
Which environments are affected, and what the patch changes
This vulnerability affects many environments, since it impacts Windows Server 2012 through Windows Server 2025, including Server Core editions. Of course, several conditions must be met for the vulnerability to be exploitable, starting with the presence of an enterprise certification authority integrated into Active Directory. The following prerequisites also apply:
- An enterprise certification authority,
- An enrollment performed through the default machine certificate template.
- A default
ms-DS-MachineAccountQuotavalue (ideally, you have already limited it if you follow best practices), or a machine account already controlled by the attacker. - The vulnerable server and the attacker’s machine must be able to communicate over the network via SMB and LDAP.
No administrator privileges are required, and no user interaction is needed either. That is precisely what makes this flaw interesting for an attacker who has already gained a foothold inside a company’s internal network.
The binary analysis carried out by the researchers shows that the update adds a validation function in certpdef.dll, the enterprise policy module loaded by the certificate service. Before following a chase, the certification authority now does what it should have done long ago: verify that the target advertised in cdc really is a domain controller registered in the directory.
One point deserves the attention of admins. According to the researchers, this new validation would be governed by an internal software switch (a feature gate, identified by the researchers as Feature_3185813818). In short, this is a built-in flag in the binary that Microsoft can enable or disable, and which determines whether the new protection is enforced. When this switch is not active, the code would fall back to the old behavior, preserved for compatibility reasons. As H0j3n and Aniq Fakhrul summarize the lab validation: "the feature state matters, because the protected path is conditional". The system’s new behavior is indeed to enable this mechanism to protect you from the flaw, but it is an interesting subtlety.
No known exploitation so far, but public code is available
As of today, there is no reported in-the-wild exploitation of this vulnerability. In fact, it is not listed in the CISA KEV catalog, which is a good sign. But let’s stay cautious: exploit code has been available on GitHub since today, Friday, July 24, 2026.
To protect yourself against the Certighost flaw, deploy the July 2026 updates on your AD CS servers. That is the best way to protect yourself, regardless of your environment’s configuration (which is a topic in its own right).
Beyond the patch, this vulnerability is a reminder that you should regularly audit your PKI infrastructure with PSPKIAudit to understand the real state of your CA. Then check the value of ms-DS-MachineAccountQuota: allowing a standard user to create up to 10 machine accounts remains an interesting entry point for many Active Directory attacks.
For more information, I’ll point you to the GitHub repository published by the researchers.
