Security researchers who discovered and reported CVE-2026-54121 (aka “Certighost”), a critical privilege elevation vulnerability in Active Directory Certificate Services (AD CS), have released a proof-of-concept (PoC) exploit and technical details related to the flaw. This development raises the urgency for organizations to apply the July 2026 security updates from Microsoft, as the availability of a public exploit increases the likelihood of real-world attacks.
The Vulnerability
Active Directory Certificate Services (AD CS) is a Windows Server role that enables organizations to deploy their own Public Key Infrastructure (PKI). It functions as a Certificate Authority (CA), issuing and managing digital certificates used for authentication, encryption, and signing across a network. AD CS is a cornerstone of many enterprise security architectures, making any vulnerability in it particularly dangerous.
CVE-2026-54121 is a critical improper-authorization flaw with a CVSS score of 8.8 out of 10. According to Microsoft's advisory, “An authenticated attacker could manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via Public Key Cryptography for Initial Authentication in Kerberos (PKINIT).” If a Domain Controller account is targeted, the attacker can authenticate as the Domain Controller and gain the ability to perform privileged Active Directory operations, ultimately leading to full domain compromise.
This vulnerability was discovered and reported to Microsoft by researchers Aniq Fakhrul and Muhammad Ali. They demonstrated that the flaw lies in a specific fallback behavior within the AD CS Certification Authority during certificate enrollment. When the CA processes an enrollment request, it normally resolves the requester's identity by looking up a directory object. In certain cross-domain-controller enrollment scenarios, the CA may perform a secondary directory lookup (referred to as a “chase”) by reaching out to another host to fetch the identity data.
The chase can be manipulated by the requester through two attributes supplied in the certificate request: cdc (Client DC), which names the host the CA should contact, and rmd (Remote Domain), which names the principal the CA should look up. When both are present, the CA opens SMB and LDAP connections to the attacker-controlled host named in cdc, searches for the principal named in rmd, and then uses whatever identity data it receives while building the certificate. The rogue endpoint passes the CA's authentication checks because a machine account created through the default ms-DS-MachineAccountQuota setting is itself a valid domain principal. This allows the attacker-controlled chase host to satisfy the checks the CA requires to continue, even though it is not the Domain Controller being impersonated.
The end result is that the attacker obtains a CA-signed certificate that authenticates as a target Domain Controller. This certificate can be used via PKINIT to obtain Kerberos credentials for that DC account. Because Domain Controller accounts hold directory replication rights, the attacker can then run a DCSync operation to extract the krbtgt account secret—the master key underpinning Kerberos in the domain. This effectively turns an ordinary domain-user account into full domain compromise, giving the attacker complete control over the Active Directory environment.
Historical Context and Similar Vulnerabilities
This vulnerability is part of a broader trend of attacks targeting Active Directory Certificate Services. Previous notable flaws include PetitPotam (CVE-2021-36942), which allowed attackers to coerce a remote server to authenticate to a malicious NTLM relay, and the various AD CS abuse techniques documented by researchers like Will Schroeder and Lee Christensen (e.g., ESC1 through ESC8). CVE-2026-54121 is particularly dangerous because it combines a certificate enrollment manipulation with PKINIT-based authentication to achieve a domain takeover without requiring high privileges initially.
The exploitation pathway resembles that of the “DFSCoerce” or “ShadowCoerce” attacks, where an authenticated user forces a privileged account to authenticate to an attacker-controlled service. However, Certighost exploits a unique mechanism within AD CS's internal directory resolution logic, making it distinct from previous coercing attacks. Microsoft's assessment initially rated this vulnerability as “less likely” to be exploited, but the public release of a PoC exploit changes that calculus.
Mitigation and Workarounds
Microsoft’s July 2026 cumulative updates for various Windows 10 and Windows Server versions address this flaw by validating the “chase” target before the lookup proceeds. Administrators should prioritize applying these updates to all AD CS hosts. For environments where immediate patching is not feasible, a registry-based workaround can disable the vulnerable code path entirely.
The researchers provided the following steps to disable the chase fallback: use certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC to modify the registry, then restart the CA service with Restart-Service CertSvc -Force. This change switches off the optional fallback feature that allows the CA to contact another host for identity resolution. While this workaround may affect some legitimate cross-domain enrollment scenarios, it effectively blocks the exploitation vector.
As of the latest update, there are no known reports of attackers exploiting CVE-2026-54121 in the wild. However, with the PoC exploit now publicly available, security teams should monitor for any signs of malicious activity, such as unusual certificate requests containing cdc and rmd attributes, or unexpected Kerberos ticket requests for Domain Controller accounts. The release of the exploit code also underscores the importance of maintaining a robust patch management process and implementing additional security controls like certificate template hardening, proper access control lists on machine accounts, and monitoring for anomalous LDAP and SMB connections to CA servers.
Given the critical severity of this vulnerability and the availability of a working exploit, organizations should treat CVE-2026-54121 as an immediate priority. Delay in remediation could leave Active Directory environments exposed to complete domain compromise, which would grant attackers full access to all systems, data, and user accounts within the organization.
Source:Help Net Security News