Security researchers H0j3n and Aniq Fakhrul have identified a critical vulnerability, named Certighost, which allows low-privileged Active Directory users to impersonate domain controllers. This flaw, published on July 24, 2026, can potentially enable unauthorized access by obtaining a certificate for a Domain Controller, thereby authenticating as that machine. The issue primarily impacts the Active Directory Certificate Services (AD CS) and was assigned CVE-2026-54121 with a CVSS score of 8.8.
Understanding the Vulnerability
Certighost operates by exploiting improper authorization within AD CS, requiring only network access and a basic domain account, without the need for administrative rights or user interaction. In practical tests, even a standard Domain Users account could leverage this flaw by creating or reusing a computer account, subject to the default ms-DS-MachineAccountQuota value of 10. This process necessitates an Enterprise CA that follows the vulnerable chain path for certificate enrollment, along with network connectivity to the attacker’s SMB and LDAP listeners.
Microsoft addressed this vulnerability with a patch released on July 14, 2026. Organizations utilizing Enterprise CA are urged to apply these updates promptly. Although no real-world exploitations have been reported as of July 24, the proof-of-concept is publicly available, raising concerns about potential misuse.
Technical Details and Mitigation Strategies
The flaw resides in an AD CS feature known as a chase fallback, where a certification authority (CA) might not correctly validate the authenticity of a Domain Controller. Researchers demonstrated that a CA could be misled by a rogue Local Security Authority (LSA) and LDAP services, leading to unauthorized certificate signing. Attackers could relay the CA’s authentication challenge to a genuine Domain Controller through Netlogon, ultimately compromising its identity.
To mitigate this risk temporarily, administrators can disable the chase fallback, though this might disrupt legitimate certificate enrollments. The recommended command to implement this workaround is:
certutil -setreg policyEditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force
Patch Implementation and Future Outlook
Microsoft’s patch introduces a validation step within certpdef.dll, ensuring that only legitimate domain controllers are followed during the chase. This update restricts IP literals, overly long names, and LDAP metacharacters, while requiring a specific Active Directory computer object match.
The vulnerability affects a range of systems, including Windows Server editions from 2012 to 2025 and certain Windows 10 versions. Security teams should prioritize patching and consider the temporary workaround where immediate updates are not feasible.
The Certighost vulnerability underscores the need for robust security practices and timely updates. Organizations should remain vigilant, continuously evaluating their security posture to prevent unauthorized access and data breaches.
