Certighost: Standard User to Domain Admin via AD CS Flaw

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24, 2026 for a critical Active Directory Certificate Services (AD CS) vulnerability that allows low-privileged domain users to obtain a certificate for a Domain Controller and authenticate as that machine. The flaw, codenamed Certighost and tracked as CVE-2026-54121 (CVSS 8.8), enables full domain compromise through DCSync and krbtgt extraction.

Microsoft patched the issue on July 14, 2026 as part of the July Patch Tuesday updates. The researchers reported the flaw on May 14, Microsoft confirmed on May 22, and public disclosure occurred on July 24.

Vulnerability Details

Property	Value
CVE ID	CVE-2026-54121
CVSS v3.1	8.8 (High)
Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High
CWE	CWE-284: Improper Access Control
Vendor Advisory	MSRC CVE-2026-54121
CISA KEV	Not listed as of July 24, 2026

Affected Products (per NVD):

Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core)
Windows 10 versions 1607, 1809

The vulnerability exists in the AD CS enrollment "chase" fallback mechanism. When a Certification Authority (CA) cannot obtain the requester's information directly, the Windows enrollment protocol allows the requester to supply cdc (the AD server to contact) and rmd (the machine object to resolve). The CA follows the requester-supplied cdc over SMB and LDAP without verifying it is a legitimate Domain Controller.

An attacker with a standard Domain Users account can:

Create a computer account (default ms-DS-MachineAccountQuota = 10) or reuse one they control
Run rogue LSA and LDAP listeners on ports 445 and 389
Relay the CA's authentication challenge to the real Domain Controller via Netlogon
Return the target DC's objectSid and dNSHostName to the CA
Obtain a certificate containing the DC's identity
Use PKINIT to authenticate as the Domain Controller
Perform DCSync to extract krbtgt and all domain secrets

Impact Assessment

What's at risk:

Full domain compromise from a standard user account
krbtgt extraction → golden ticket capability
All domain secrets via DCSync
Persistence at the highest privilege level
Lateral movement to any domain-joined system

Who needs to act:

Any organization running an Enterprise CA with AD CS
Environments using the default Machine certificate template
Domains where ms-DS-MachineAccountQuota > 0 (default is 10)

The exploit requires:

Network access to the CA and Domain Controller
A domain user account (any standard user)
An Enterprise CA following the vulnerable chase path
Default Machine certificate template enabled
Network reachability from CA to attacker's SMB/LDAP listeners

Affected Systems

OS Version	Status
Windows Server 2025	Affected
Windows Server 2022	Affected
Windows Server 2019	Affected
Windows Server 2016	Affected
Windows Server 2012 R2	Affected
Windows Server 2012	Affected
Windows 10 1809	Affected
Windows 10 1607	Affected

Mitigation & Patching

Immediate fix: Install the July 14, 2026 security updates on all AD CS hosts.

Microsoft Update Guide: CVE-2026-54121
Updates are cumulative; latest monthly rollup includes the fix

If immediate patching is not possible: Disable the chase fallback on the CA:

powershell

The researchers tested this mitigation in a controlled lab. Microsoft recommends the July update as the permanent fix. Stage the registry change in a test environment first—it can break legitimate enrollment flows.

Additional hardening:

Reduce ms-DS-MachineAccountQuota to 0 (prevents standard users from creating computer accounts)
Restrict Certificate Template permissions: remove "Enroll" from "Domain Users" on Machine template
Enable CA auditing for successful and failed operations
Monitor Security Event IDs 4886, 4887 for unusual certificate requests

Detection

Microsoft Defender alerts:

"Potential Certighost (CVE-2026-54121) AD CS abuse"
"Active Directory Certificate Services attack tool activity"

Event log monitoring:

Event ID 4886 (Certificate Services received a request)
Event ID 4887 (Certificate Services approved a request)
Look for Machine template certificates issued to accounts that shouldn't have them
Watch for certificates containing DC objectSid / dNSHostName in Subject/AN

Suricata rule for Certighost enrollment traffic:

alert tcp any any -> $DC_SERVERS 445 (msg:"CERTIGHOST AD CS Chase SMB Relay"; flow:to_server,established; content:"|ff|SMB"; offset:4; depth:5; content:"IPC$"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:202654121; rev:1;)
alert tcp any any -> $DC_SERVERS 389 (msg:"CERTIGHOST AD CS Chase LDAP Query"; flow:to_server,established; content:"|30|"; offset:0; depth:1; content:"objectSid"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:202654122; rev:1;)

YARA rule for Certighost exploit binary:

yara

Sigma rule for suspicious certificate enrollment:

title: Suspicious AD CS Certificate Enrollment for Domain Controller
id: 20260728-certighost-dc-enrollment
status: experimental
description: Detects Machine template certificate requests containing DC identity attributes
logsource:
    category: application
    product: adcs
detection:
    selection_template:
        CertificateTemplate: "Machine"
    selection_dc_attrs:
        Subject|contains:
            - "DC="
            - "CN="
    selection_dc_sid:
        Extension|contains: "objectSid"
    condition: selection_template and (selection_dc_attrs or selection_dc_sid)
fields:
    - Requester
    - CertificateTemplate
    - Subject
    - Extensions
level: critical
tags:
    - attack.credential_access
    - attack.t1003.006
    - attack.t1558.004

Frequently Asked Questions

Q: Does this affect Standalone CAs? A: No. The chase fallback only exists in Enterprise CAs integrated with Active Directory.

Q: Is the default Machine template the only vulnerable template? A: The published exploit targets the Machine template, but any template that allows client authentication and is available to Domain Users with the chase path enabled could be abused.

Q: Can I just block ports 445/389 from the CA to the internet? A: The attack requires the CA to connect to the attacker's listeners on 445/389. Blocking inbound to the CA doesn't help; you must prevent the CA from reaching untrusted hosts, or patch.

Q: What if I already disabled MachineAccountQuota? A: Setting ms-DS-MachineAccountQuota to 0 blocks the computer account creation step, but an attacker who already controls a computer account (or can compromise one) can still exploit the chase flaw.

Q: Has this been exploited in the wild? A: Microsoft stated on July 24 they observed "researcher testing activity" but have not confirmed threat actor exploitation. The public PoC raises the likelihood of exploitation attempts.

Q: How does the July 2026 patch fix this? A: Microsoft added CRequestInstance::_ValidateChaseTargetIsDC to certpdef.dll. The validation:

Rejects IP literals and overlong names in cdc
Rejects LDAP metacharacters
Requires exactly one matching AD computer object whose DNS name matches the target
Requires userAccountControl includes SERVER_TRUST_ACCOUNT (8192)
Performs SID comparison to block object substitution

Key Takeaways

AD CS remains a high-value target: The chase fallback is a known weak point; this is the third major AD CS vulnerability class (after ESC1-ESC8 and Certifried).
Low-privilege to Domain Admin in one chain: A standard user → computer account → DC certificate → DCSync → krbtgt is a complete kill chain.
Patch AD CS hosts first: The CA is the choke point. July 14 updates on all CA servers break the chain.
Monitoring is not optional: Enable CA auditing (Event IDs 4886, 4887). Watch for Machine template certificates with DC attributes.
Reduce attack surface: Set MachineAccountQuota = 0. Restrict Machine template enrollment to specific groups.

Conclusion

Certighost (CVE-2026-54121) demonstrates that AD CS enrollment fallback logic remains a fertile ground for privilege escalation. The fix is straightforward—apply the July 14 updates to all Enterprise CA servers. If you cannot patch immediately, disable the chase fallback via registry and restart Certificate Services, but test thoroughly first. The exploit is public, the kill chain is reliable, and the impact is total domain compromise. Treat this as a critical priority.

Sources:

Automated Transmission

This entry was synthesized and populated dynamically using native API integrations.

Hello.

Certighost CVE-2026-54121: AD CS Domain Takeover from Standard User