Certighost: How a Low-Privileged AD User Can Impersonate a Domain Controller via AD CS

A regular domain user with no admin rights, no phishing tricks, and no zero-day malware can now become a Domain Controller. That’s Certighost, the Active Directory Certificate Services flaw disclosed on July 24 by researchers H0j3n and Aniq Fakhrul — and if your organization runs an Enterprise CA and skipped Microsoft’s July 14 patch, an attacker with a Domain Users account already has everything they need to DCSync the krbtgt hash and forge tickets across your forest.

Why Certighost Turns a Standard Domain Account Into a Domain Controller

According to the researchers, Certighost — tracked as CVE-2026-54121 and rated CVSS 8.8 by Microsoft — abuses an AD CS enrollment fallback called a “chase.” When a certification authority can’t resolve an end entity’s information, the Windows enrollment protocol lets the request specify cdc (the AD server to contact) and rmd (the machine object to resolve). The CA was following the requester-supplied cdc over SMB and LDAP without ever proving it was talking to a real Domain Controller.

This matters because it collapses the trust boundary between machine identity and machine authentication. An attacker stands up rogue LSA and LDAP services, relays the CA’s Netlogon challenge to the real DC, returns the target DC’s objectSid and dNSHostName, and walks away with a certificate the CA happily signed for the Domain Controller’s identity. From there, PKINIT lets them authenticate as the DC and pull the krbtgt secret through DCSync.

If your team runs an Enterprise CA with the default Machine template and hasn’t touched ms-DS-MachineAccountQuota (still at 10), any user in Domain Users can create the computer account the exploit needs. That’s not a targeted attack profile — that’s Tuesday.

Our take: It’s the most consequential AD CS bug since ESC1, and any forest that treats AD CS as “set and forget” infrastructure is going to learn that lesson the hard way over the next 90 days.

What the Public Proof-of-Concept Actually Automates

The fact: Aniq Fakhrul’s public exploit on GitHub automates the entire chain. It creates or reuses a computer account (via --computer-name), starts listeners on ports 445 and 389, relays the CA’s challenge to the real Domain Controller over Netlogon, submits the malicious cdc and rmd attributes, and drops a PFX file plus a Kerberos credential cache to disk.

Why it matters: When a full weaponized chain is public on day one of disclosure, the window for defenders is measured in hours, not weeks. Red teams will bake this into engagements immediately; opportunistic attackers who already have a foothold via infostealer credentials will find this a trivial escalation path. The exploit doesn’t require administrator rights or user interaction — only network access and a domain account.

Practical example: If you’re an MSP managing dozens of client forests, assume every environment where AD CS is deployed and July patches are pending is now trivially exploitable by any compromised low-privilege account — including service accounts you may have forgotten about. It’s the same class of risk engineers factor in when comparing blockchain-anchored identity models against traditional AD-backed databases for high-trust workflows.

Our take: Expect Certighost to show up in ransomware playbooks within the quarter. Groups that already automate BloodHound + Certipy pipelines will fold this in almost immediately.

How Microsoft’s July Patch Actually Fixes the Chase

The fact: The researchers’ binary analysis shows Microsoft’s July update adds CRequestInstance::_ValidateChaseTargetIsDC to certpdef.dll before the CA follows any chase. The new validation rejects IP literals, overlong names, and LDAP metacharacters. It requires exactly one matching AD computer object whose DNS name matches the target and whose userAccountControl includes SERVER_TRUST_ACCOUNT (8192). A follow-up SID comparison blocks object substitution.

Why it matters: It’s a defense-in-depth fix, not a single-line patch. Microsoft is treating the class of “trust the requester’s server hint” bugs seriously — the validation checks for the exact primitives (IP literals, injection characters, weak object matching) that have historically enabled AD CS relay attacks. If you’ve been tracking the ESC-series bugs since 2021, this pattern should feel familiar.

Practical example: If you run a regulated environment — think hospitals with EHR systems on the same AD forest, where a domain compromise cascades directly into patient data exposure — the July update on AD CS hosts moves from “planned maintenance” to “emergency change window.” Teams building compliance-driven healthcare platforms should audit every issuing CA in scope before the end of the week.

Our take: Microsoft’s decision to validate SERVER_TRUST_ACCOUNT at the CA layer will probably become the reference pattern for other identity fabric vendors within a year.

The Mitigation Trap for Teams That Cannot Patch Immediately

The fact: Per the researchers, administrators who cannot deploy the July update immediately can clear the chase flag and restart Certificate Services with certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC followed by Restart-Service CertSvc -Force. The researchers tested this only in a controlled lab and warn it can break legitimate enrollment flows.

Why it matters: Change advisory boards love workarounds because they defer risk without deploying binaries. But this workaround disables an enrollment path some legitimate clients depend on — meaning your first alert may not be Certighost exploitation, it may be your monitoring server failing to enroll for its scheduled cert rotation. Stage this in a test forest first.

Practical example: If you’re a supply-chain platform relying on machine certificates for mTLS between fleet devices and a central control plane — the kind of architecture common in end-to-end logistics traceability systems — flipping the chase flag off could silently break device re-enrollment overnight. Patch beats mitigate here.

Our take: Half the teams that apply the workaround will forget to apply the actual patch. Ninety days from now, incident responders will still be finding forests where EDITF_ENABLECHASECLIENTDC is cleared but certpdef.dll is unpatched — a compliance win with no real security value.

FAQ

Q: What is CVE-2026-54121 (Certighost)? A: It’s an improper-authorization flaw in Active Directory Certificate Services that lets a low-privileged domain user obtain a certificate for a Domain Controller by abusing the chase enrollment fallback. Microsoft assigned it a CVSS score of 8.8 and patched it on July 14, 2026.

Q: Is Certighost being exploited in the wild? A: As of July 24, no primary source reviewed by The Hacker News reported in-the-wild exploitation, and the flaw was absent from CISA’s Known Exploited Vulnerabilities catalog. However, a full weaponized proof-of-concept is publicly available on GitHub, so absence of reporting does not prove absence of exploitation.

Q: Which systems are affected? A: The NVD record lists Windows Server 2012 through Windows Server 2025 (including Server Core editions) and Windows 10 versions 1607 and 1809. Exploitation requires an Enterprise CA using the vulnerable chain path and the default Machine certificate template.

Key Takeaways

• Patch AD CS hosts with Microsoft’s July 14 update before running any other Certighost mitigation — the workaround is a stopgap, not a fix.
• Audit ms-DS-MachineAccountQuota across every domain; the default value of 10 is the enabler that makes this exploit trivial for any Domain Users member.
• Treat any Enterprise CA as tier-0 infrastructure with the same change control and monitoring rigor you apply to Domain Controllers themselves.
• Expect this exploit primitive to be folded into ransomware operator toolkits and red team frameworks within the next quarter — assume adversaries have the PoC now.
• Build detection for anomalous computer account creation followed by certificate enrollment against the Machine template — it’s the highest-signal indicator of Certighost abuse in the wild.