A newly disclosed Active Directory Certificate Services (AD CS) vulnerability, dubbed Certighost, allowed a low-privilege domain user to impersonate a Domain Controller and take over an entire Active Directory domain.<\/p>\n
Tracked as CVE-2026-54121, the flaw was patched in Microsoft\u2019s July 2026 security updates<\/a> following responsible disclosure earlier this year.<\/p>\n AD CS is Microsoft\u2019s public key infrastructure (PKI) system, issuing X.509 certificates used for encryption, signing, and authentication across a domain. Certificates act like digital ID cards: a Certification Authority (CA) signs them, binding a public key to an identity that other services can trust.<\/p>\n One key use case is certificate-based Kerberos authentication (PKINIT), where a client requests a certificate and later presents it to the Key Distribution Center (KDC) to obtain a Kerberos ticket. The KDC maps the certificate\u2019s identity data to an AD account \u2014 and this mapping process is exactly where Certighost breaks down.<\/p>\n During certain enrollment scenarios, the CA performs a secondary directory lookup called a chase, controlled by two request attributes:<\/p>\n The vulnerable CA code trusted whatever host was supplied in An attacker could stand up rogue SMB, LDAP, and LSA services on their own machine, point the CA at it via Combined with a machine account created through the default Once the CA issued a certificate carrying the impersonated DC\u2019s identity data, the attacker could authenticate as that Domain Controller.<\/p>\n Since DCs hold directory replication rights, this access enabled a DCSync attack<\/a> extracting sensitive secrets including the krbtgt account hash, effectively handing over full domain control.<\/p>\n Microsoft\u2019s July 2026 patch introduces a new validation function, Only after these checks pass does the CA proceed with the chase and certificate issuance.<\/p>\n Organizations unable to deploy the July update right away can disable the vulnerable chase fallback with:<\/p>\n This is a temporary mitigation, not a fix \u2014 if the flag is re-enabled later (via policy, imaging, or an admin action), the CA becomes exploitable again. Test this in staging first, since any legitimate workflows relying on the chase fallback will break.<\/p>\n A proof-of-concept is available on GitHub<\/a>. Organizations running AD CS should prioritize patching immediately and audit \u00a0Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations.\u00a0->\u00a0Integrate ANY.RUN With Your SOC\u00a0<\/a>Now<\/a><\/strong>.<\/strong><\/p>\n The post Certighost Active Directory CS Exploit Allows Low-Privileged Users to Compromise Domain<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"\"](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiL7t4zzrG7pEq45oG9p473HnpGvpQoTYdDPUjOoEea0UheqqEpzLdVEKueBc5pGxVP35RdAFLEsoJrKilPOUWSycO1MGCLgO2aapcSCua-XSJS2S5VvQh1OAIVvD0AlQksdOo2uLE04zsSvdjSqcmIw-nT6YJo_Aj4AumIiJmCwzQQgqO5U6wfa8kS1WZX\/s1600\/mapp.webp?ssl=1\")
\n
cdc<\/code> (Client DC) \u2014 specifies the host the CA should contact<\/li>\nrmd<\/code> (Remote Domain) \u2014 specifies the principal to look up<\/li>\n<\/ul>\ncdc<\/code> without verifying it was an actual Domain Controller, reads the advisory<\/a>.<\/p>\ncdc<\/code>, and return fabricated identity data including a real DC\u2019s SID and DNS hostname for the rmd<\/code> target.<\/p>\nms-DS-MachineAccountQuota<\/code> setting (which lets any user register up to 10 machine accounts), an attacker\u2019s rogue host could pass the CA\u2019s authentication checks as a \u201cvalid\u201d domain principal, even though it wasn\u2019t the DC it claimed to be.<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgYycxgYFE_v-cnwnjW7oZBmy3R_bA0ZHTVQdupZ_KEPP6XAfszMzU2nYj9l8chHcwpeCzvXD1dwwdF87A9ykOsBhZxWGt4RCBHrxcH1eEaU-Us7kfeT3F00wKyaWxja4RHBJLu4SD2UBFWWc5kDsHjt_8OBLOBoSnNhXezT6yib_U3v5pERHt2O6AdtTLn\/s1600\/Domain%2520Controller%2520imper.webp?ssl=1\")
_ValidateChaseTargetIsDC<\/code>, gated behind a servicing flag (Feature_3185813818<\/code>). Before the CA follows a cdc<\/code> target, it now:<\/p>\n\n
SERVER_TRUST_ACCOUNT<\/code> flag (value 8192)<\/li>\nMitigation If You Can\u2019t Patch Immediately<\/strong><\/h2>\n
text
certutil -setreg policyEditFlags -EDITF_ENABLECHASECLIENTDC\nRestart-Service CertSvc -Force<\/code><\/pre>\nEDITF_ENABLECHASECLIENTDC<\/code> settings across all Enterprise CAs.<\/p>\n