# Microsoft Addresses Critical Vulnerability in Active Directory Certificate Services

*Published July 29, 2026*
*Source: [https://www.darkreading.com/vulnerabilities-threats/certighost-flaw-microsoft-active-directory-certificates](https://www.darkreading.com/vulnerabilities-threats/certighost-flaw-microsoft-active-directory-certificates)*

## Executive Summary

Microsoft has patched a critical vulnerability in Active Directory Certificate Services that allowed unauthorized domain controller impersonation. The flaw, named 'Certighost', was due to a defective trust boundary and has been addressed in the latest security update.

## Article

A serious vulnerability in Microsoft's Active Directory Certificate Services (AD CS), dubbed 'Certighost', has been patched following its discovery by researchers Aniq Fakhrul and Muhammad Ali. This flaw, identified as CVE-2026-54121, allowed attackers with low-level domain privileges to impersonate a domain controller, potentially compromising entire Active Directory environments. The issue arose from a defective trust boundary within the certificate-based client authentication process, specifically involving a 'chase', a directory lookup mechanism used in cross-domain controller scenarios.

The vulnerability was discovered to manipulate the certificate authority (CA) into querying an attacker-controlled server for Active Directory identity data. This flaw allowed attackers to run LDAP and LSA services on a server they controlled and redirect CA queries, resulting in unauthorized certificates being issued. The researchers highlighted that the core problem was Active Directory's reliance on its directory as the sole source of truth, enabling certificate authorities to trust whatever the directory provides without additional verification.

The patch released by Microsoft as part of its July Patch Tuesday updates addresses two main issues: ensuring the chase target must be an AD-registered domain controller and verifying that the resolved object matches the expected identity. While this patch mitigates the specific flaw, experts suggest that organizations should treat certificate enrollment as a security boundary. For those unable to immediately apply the patch, a temporary workaround involves disabling the vulnerable chase behavior, although this should be tested for compatibility with existing workflows.

The researchers responsibly disclosed the flaw to Microsoft, leading to a swift investigation and patch development. This incident underscores the importance of maintaining robust security protocols within certificate services, especially as organizations transition towards post-quantum encryption methods.