On July 24, researchers H0j3n and Aniq Fakhrul unveiled an exploit named Certighost that allows low-privileged Active Directory users to impersonate Domain Controllers by obtaining their certificates. This exploit leverages an improper authorization flaw in Microsoft's Active Directory Certificate Services, which was patched on July 14 and identified as CVE-2026-54121. The vulnerability boasts a high CVSS score of 8.8, indicating significant potential impact.
The flaw allows an attacker with a network connection and a domain account, but not necessarily admin rights, to exploit the system. In tests, even a regular Domain User account could create or reuse a computer account to initiate the attack. This process requires the presence of an Enterprise CA that adheres to the vulnerable chain path and can connect to the attacker's SMB and LDAP listeners.
Organizations operating an Enterprise CA are advised to apply Microsoft's July patch to safeguard their AD CS hosts. Although the proof-of-concept exploit is publicly available, reports of its exploitation in real-world scenarios have not yet surfaced.
The Certighost exploit manipulates the AD CS enrollment fallback mechanism, known as a chase, which occurs when a CA cannot directly obtain an end entity's information. By exploiting this, an attacker can trick the CA into authenticating a rogue machine as a legitimate Domain Controller and issue a corresponding certificate. This enables the attacker to request sensitive account secrets using DCSync, posing a risk of full directory compromise.
To address this vulnerability, Microsoft has introduced a validation process in the latest update, which ensures that only legitimate Domain Controllers are involved in the chase process. This update includes additional security checks to prevent misuse of the enrollment protocol. Despite the availability of a temporary workaround to disable the chase fallback, the July patch remains the preferred solution.