An Active Directory Certificate Services (AD CS) vulnerability known as Certighost, identified as CVE-2026-54121, was recently revealed. This flaw allows low-privilege users to impersonate a Domain Controller, potentially leading to complete control over an Active Directory domain.
Understanding Certighost and Its Impact
The Certighost vulnerability was addressed in Microsoft’s July 2026 security updates. This flaw affects Microsoft’s public key infrastructure (PKI), which issues X.509 certificates for encryption, signing, and authentication within domains. These certificates function similarly to digital IDs, with a Certification Authority (CA) authorizing them by linking a public key to a particular identity.
The vulnerability is particularly critical in scenarios involving certificate-based Kerberos authentication (PKINIT). Here, the flaw disrupts the correlation between a certificate and its associated AD account, due to issues in the mapping process performed by the Key Distribution Center (KDC).
Technical Details of the Vulnerability
Certighost exploits a specific aspect of the CA’s operations: a secondary directory inquiry known as a chase. This process is influenced by two attributes: cdc (Client DC) and rmd (Remote Domain). The vulnerability arises because the CA does not verify whether the host specified in the cdc attribute is a legitimate Domain Controller.
By setting up malicious SMB, LDAP, and LSA services, attackers can manipulate the CA into accepting false identity data. This includes supplying a real Domain Controller’s Security Identifier (SID) and DNS hostname for the rmd target, thus bypassing normal authentication checks.
Mitigation and Future Outlook
To mitigate the risk, Microsoft introduced a validation function, _ValidateChaseTargetIsDC, in its July patch. This function performs several checks, such as rejecting invalid hostnames and confirming the target’s authenticity as a computer object. Only if these criteria are met does the CA proceed with the chase and issue the certificate.
For organizations unable to immediately apply the July patch, a temporary workaround involves disabling the vulnerable chase feature through a specific command. However, this is not a permanent solution, and organizations are urged to prioritize patching.
A proof-of-concept has been published on GitHub, emphasizing the urgency for enterprises utilizing AD CS to update their systems and audit relevant settings to prevent exploitation.
Strengthening security operations by integrating advanced threat detection tools can further safeguard against such vulnerabilities.
.webp?ssl=1 "CISA Alerts on Active Exploitation of Google Chromium Vulnerability")
