Certighost Exploit Allows Low-Privileged AD Users to Impersonate Domain Controllers

Key Takeaways

• A newly disclosed flaw in Active Directory Certificate Services (AD CS) – tracked as CVE‑2026-54121 – lets a low‑privileged domain user obtain a certificate for a Domain Controller and then extract the krbtgt secret via DCSync.
• Exploitation only requires network reachability to an Enterprise CA and a regular domain account; no admin rights or user interaction are needed.
• The vulnerability resides in the “chase” enrollment fallback, where the CA trusts attacker‑supplied cdc (DC hostname) and rmd (machine object) values without verifying they belong to a genuine Domain Controller.
• Researchers demonstrated a working proof‑of‑concept (Certighost) that creates or reuses a computer account, runs rogue SMB/LDAP listeners, relays the CA’s Netlogon challenge to a real DC, and obtains a Kerberos ticket usable for DCSync.
• Microsoft released a patch on July 14, 2026, adding validation logic (CRequestInstance::_ValidateChaseTargetIsDC) that blocks IP literals, overlong names, LDAP metacharacters, and ensures the targeted object is a legitimate DC.
• As a temporary mitigation, administrators can disable the chase flag via certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC and restart the Certificate Services service, but the update is the recommended permanent fix.
• No wild exploitation was reported as of July 24, 2026, though the full exploit was publicly released, underscoring the urgency of patching.

Overview of the Certighost Vulnerability
On July 24, 2026, researchers H0j3n and Aniq Fakhrul published a working exploit dubbed Certighost that abuses a flaw in Active Directory Certificate Services (AD CS). The flaw permits a standard domain user—without any administrative privileges—to request and receive a certificate issued for a Domain Controller (DC). Because DC accounts hold directory‑replication rights, the resulting Kerberos credential can be leveraged to perform a DCSync attack and extract the krbtgt secret, effectively granting the attacker escalated domain control.

Technical Root Cause: The Chase Enrollment Fallback
The vulnerability lies in the AD CS enrollment mechanism known as the “chase.” When a Certification Authority (CA) cannot locate an end‑entity’s information in AD, the Windows enrollment protocol allows the requester to supply two attributes: cdc (the domain controller to contact) and rmd (the machine object to resolve). The CA then follows the attacker‑provided cdc host over SMB and LDAP without first confirming that the host is a legitimate Domain Controller. This blind trust enables an attacker to substitute a rogue server for the genuine DC.

Attack Chain Details
To exploit the chase, an attacker must:

1. Possess a domain account (e.g., a member of the Domain Users group).
2. Have network access to an Enterprise CA that uses the default Machine certificate template.
3. Be able to reach the CA’s SMB (port 445) and LDAP (port 389) listeners from the attacker’s machine.

The attacker first creates—or reuses—a computer account within the default ms‑DS‑MachineAccountQuota of 10. They then launch rogue LSA and LDAP services on ports 445 and 389. When the CA initiates its chase, it sends an authentication challenge that the attacker relays to the real Domain Controller via Netlogon. The attacker returns the DC’s objectSid and dNSHostName, satisfying the CA’s validation steps. The CA then authenticates the attacker‑controlled machine account and signs a certificate that binds the DC’s identity to the attacker’s key.

Exploitation Tool and Outcome
The public Certighost exploit automates the entire chain. With options such as --computer-name it either creates a new computer account or reuses an existing one, starts listeners on SMB and LDAP, forwards the CA’s Netlogon challenge to the genuine DC, submits the crafted cdc and rmd attributes, and outputs a PFX file plus a Kerberos credential cache. Using PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), the attacker authenticates as the targeted Domain Controller. The resulting Kerberos ticket can request directory replication rights via DCSync, allowing extraction of the krbtgt hash and, consequently, the ability to forge any Kerberos ticket in the domain.

Microsoft’s Patch and Mitigations
Microsoft addressed the issue on July 14, 2026, as CVE‑2026-54121, classifying it as an improper authorization flaw with a CVSS score of 8.8. The patch modifies certpdef.dll by inserting a new validation routine, CRequestInstance::_ValidateChaseTargetIsDC, which executes before the CA follows a chase. This routine:

• Rejects IP literals, overly long names, and LDAP metacharacters in the supplied cdc.
• Requires exactly one matching AD computer object whose DNS name equals the target and whose userAccountControl includes the SERVER_TRUST_ACCOUNT flag (8192).
• Performs a SID comparison to prevent object substitution attacks.

For environments unable to apply the update immediately, researchers suggest a temporary workaround: disabling the chase flag via

powershell
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force

They caution that this can interrupt legitimate enrollment flows and advise testing in a lab before production deployment, treating the July update as the permanent solution.

Scope, Testing, and Disclosure Timeline
The exploit was validated in a Windows Server 2016-or-later forest with an Enterprise CA, the default Machine template, and the default machine‑account quota. The NVD entry extends the affected range to Windows Server 2012 through Windows Server 2025 (including Server Core editions) and Windows 10 versions 1607 and 1809. The researchers reported the flaw to Microsoft on May 14, 2026; Microsoft confirmed it on May 22 and released the patch on July 14. Public disclosure followed on July 24, 2026, coinciding with the release of the full proof‑of‑concept code. As of the disclosure date, no primary source observed by The Hacker News reported active exploitation in the wild, although the absence of reports does not guarantee that the vulnerability has not been used elsewhere.

Recommendations for Administrators

• Prioritize installing the July 14, 2026, AD CS update on all Enterprise CA hosts.
• Verify that the CRequestInstance::_ValidateChaseTargetIsDC validation is present in certpdef.dll (version 10.0.xxxxx.x or later).
• If immediate patching is infeasible, apply the chase‑disable workaround only after thorough testing in a non‑production environment.
• Monitor for anomalous certificate requests targeting Domain Controller accounts and for unexpected Netlogon relay activity.
• Enforce least‑privilege principles and consider reducing the ms‑DS‑MachineAccountQuota where possible to limit the ability to create new computer accounts.

By applying the patch and adhering to these defensive measures, organizations can close the attack vector that Certighost exploits and protect their Active Directory environments from credential‑theft and domain‑wide compromise.