Press play to start listening
Microsoft has patched a high-severity vulnerability in Active Directory Certificate Services that allowed a user with basic domain access to obtain a valid certificate identifying them as a Domain Controller.
Tracked as CVE-2026-54121 and named Certighost, the flaw received a CVSS score of 8.8. Researchers H0j3n and Aniq Fakhrul reported it to Microsoft in May 2026, and the company released a fix on July 14, 2026. Full technical details and a working proof of concept followed ten days later.
Active Directory Certificate Services, commonly called AD CS, issues certificates that act as trusted digital identities inside company networks. Computers and users can present these certificates when requesting access to services, including Kerberos authentication.
Certificate Authority Trusted the Wrong Server
Certighost affects a fallback process called a “chase.” When a Certification Authority cannot resolve identity information during enrollment, it may contact another directory server to complete the lookup.
A certificate request can contain a cdc value identifying the server to contact and an rmd value identifying the account or computer being requested. Before Microsoft’s update, the CA could follow the supplied address without first confirming that it belonged to a genuine Domain Controller.
An attacker could point the CA toward a server they controlled and return identity data belonging to the target Domain Controller. The CA would then place the Domain Controller’s SID and DNS name inside a certificate issued to the attacker.
Jason Soroko, senior fellow at certificate management provider Sectigo, said the cryptography itself did not fail. The signatures and certificate chain remained valid because the CA had signed the certificate correctly. The failure occurred earlier, when attacker-supplied directory information was accepted as proof of identity.
In practice, the CA acted on information from the wrong source and then produced a genuine certificate containing a false identity. This also meant Microsoft’s strong SID binding, introduced after the Certifried vulnerability in 2022, could not stop the attack because the incorrect SID had already been written into the signed certificate.
Proof of Concept Reached Domain Controller Access
The researchers tested Certighost in an enterprise lab using an Enterprise CA, the default Machine certificate template, and an ordinary Domain Users account. Their exploit created a machine account, started the necessary directory services, and submitted the crafted certificate request automatically.
After receiving the certificate, the script authenticated as the targeted Domain Controller and obtained a Kerberos credential for that account. Since Domain Controllers have directory replication rights, the researchers then used DCSync, a post-exploitation cyberattack technique, to retrieve account secrets, including the krbtgt credential used by Kerberos.
Access to that credential can lead to full domain compromise because it can be used to create forged Kerberos tickets and impersonate other accounts. The attack required valid low-level domain credentials and network access to the CA, but it did not require administrator rights or action from another user.
The demonstrated chain depended on specific conditions, including a vulnerable Enterprise CA following the chase path and certificate enrollment being available through the Machine template. The findings do not mean every Active Directory deployment could be compromised with the same steps.
Microsoft Adds Domain Controller Verification
Microsoft’s July update has changed how the CA handles the requester-supplied server address. Before performing the chase, the CA now checks Active Directory to confirm that the supplied hostname belongs to a registered Domain Controller and later verifies that the resolved SID matches the expected identity.
Organizations running AD CS should install the July 2026 security updates on every server hosting an issuing CA. Microsoft’s advisory lists affected Windows Server releases from Server 2012 through Server 2025, including Server Core installations.
Administrators unable to patch immediately can disable the Chase fallback using the policy setting documented by the researchers. They warned that this temporary measure was tested only in a lab and may disrupt legitimate certificate enrollment, making Microsoft’s update the recommended fix.
Nevertheless, the good news is that no exploitation in real attacks had been reported when the technical details were published. However, a complete public exploit is now available, giving unpatched organizations less time to address the issue.
