Summary

Certighost (CVE-2026-54121) is a critical vulnerability in Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to impersonate a Domain Controller, potentially leading to a full domain compromise. This vulnerability exploits a flaw in the AD CS enrollment process, specifically the chase fallback mechanism, which can be manipulated to issue certificates with identity data of a Domain Controller. The vulnerability was addressed in the July 2026 security updates by Microsoft. Since a PoC is available, consider this CVE as actively exploited.

Affected Systems and/or Applications

• Active Directory environments utilizing Active Directory Certificate Services (AD CS).
• Systems running Windows Server 2016 or later with AD CS configured.
• Environments where the default ms-DS-MachineAccountQuota setting is in place.
• Certificate templates that allow low-privileged users to request certificates.

Technical Details

Certighost exploits the chase fallback mechanism in AD CS, where a Certification Authority (CA) performs a secondary directory lookup using attributes cdc (Client DC) and rmd (Remote Domain). An attacker can supply these attributes in a certificate request, causing the CA to query an attacker-controlled host for identity data. The CA then uses this data to issue a certificate, allowing the attacker to impersonate a Domain Controller.

The vulnerability arises because the CA does not verify that the cdc target is a legitimate Domain Controller before using the returned data. This allows an attacker to run rogue LDAP and LSA services on a controlled host, directing the CA to that host and returning directory data for a chosen target principal. The attacker can perform actions such as DCSync to replicate directory data, including sensitive account secrets like the krbtgt hash.

The July 2026 update addresses this by adding a validation step to ensure the cdc target resolves to a legitimate Domain Controller before continuing the chase. This includes checks for hostname validity, LDAP injection prevention, and verification that the target is a registered Domain Controller.

Mitigation

1. Apply the July 2026 Security Update: Ensure that all systems running AD CS are updated with the latest security patches from Microsoft to address this vulnerability.
2. Disable Chase Fallback: If immediate patching is not possible, disable the chase fallback mechanism using the following command:
   ‍certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force
   Note: This is a temporary mitigation and should be tested in a controlled environment before deployment.‍
3. Review Certificate Templates: Restrict certificate template permissions to prevent low-privileged users from requesting certificates that could be used for domain impersonation.

What the Cyber Fusion Center is Doing

The CFC is monitoring the situation and preparing a threat-hunting campaign. This advisory will be updated if required.

References

• Detailed analysis and proof-of-concept: Certighost Analysis
• Proof-of-concept tool: Certighost PoC

For further information and updates, refer to Microsoft's official security advisories and documentation.