A critical privilege escalation vulnerability in Active Directory Certificate Services (AD CS) now has a public proof-of-concept exploit. Tracked as CVE-2026-54121 and dubbed "Certighost," the flaw allows any authenticated domain user to escalate to Domain Controller privileges and fully compromise an Active Directory forest. Microsoft patched it in July 2026, but the PoC release on July 27 changes the risk calculus dramatically.

Vulnerability Details

CVE-2026-54121 is an improper authorization vulnerability in AD CS (CWE-284) with a CVSS 3.1 score of 8.8 (Critical). The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network attack vector, low attack complexity, low privileges required (any domain user), no user interaction, and total impact.

The vulnerability exists in the AD CS Certification Authority (CA) certificate enrollment process. When a CA processes an enrollment request, it performs a directory lookup to resolve the requester's identity. In cross-domain-controller scenarios, the CA may perform a "chase" — a secondary lookup to another host to fetch identity data. This chase is controlled by two attributes the requester supplies: cdc (Client DC) naming the host to contact, and rmd (Remote Domain) naming the principal to look up.

An attacker with a standard domain account can:

1. Create a machine account (allowed by default via ms-DS-MachineAccountQuota)
2. Start rogue LDAP (port 389) and SMB (port 445) listeners
3. Submit a certificate request embedding cdc pointing to the rogue host and rmd naming a target Domain Controller
4. The CA connects to the attacker's rogue listeners, which respond with the target DC's identity
5. The CA issues a valid certificate binding the attacker's key to the DC's identity
6. Using PKINIT, the attacker obtains Kerberos credentials as the Domain Controller
7. With DC privileges, the attacker performs DCSync to extract the krbtgt hash — game over for the domain

Microsoft released patches on July 14, 2026 (July Patch Tuesday). At publication, Microsoft assessed exploitation as "Less Likely." The PoC release on July 27 by researchers Aniq Fakhrul and Muhammad Ali invalidates that assessment — functional exploit code is now public.

Impact Assessment

This is a domain takeover vulnerability. Successful exploitation yields:

• Full Domain Admin equivalent access
• Ability to extract all domain secrets (krbtgt, computer accounts, service accounts)
• Persistence via Golden Tickets forged with the krbtgt hash
• Lateral movement to all domain-joined systems
• Compromise of any application or service trusting AD authentication

Any organization running AD CS with Enterprise CAs is at risk. This includes virtually all enterprises using Windows Server for identity management.

Affected Systems

Component	Affected Versions	Fixed In
Windows Server 2025	All builds	July 2026 CU
Windows Server 2022	All builds	July 2026 CU
Windows Server 2019	All builds	July 2026 CU
Windows Server 2016	All builds	July 2026 CU
Windows 10/11 (RSAT)	When AD CS role installed	July 2026 CU

The vulnerability requires the AD CS Certification Authority role. Standalone CAs and environments without AD CS are not affected.

Mitigation & Patching

Primary fix: Apply the July 2026 Cumulative Update for your Windows Server version. This adds validation of the "chase" target before the lookup proceeds.

Immediate workaround (if patching is delayed): Disable the vulnerable cdc chase behavior via registry:

This disables the chase fallback entirely. The feature is optional — disabling it does not break standard certificate enrollment. Verify with certutil -getreg policy\EditFlags that the flag is cleared.

Additional hardening:

• Reduce ms-DS-MachineAccountQuota to 0 (prevents low-priv users from creating machine accounts)
• Enable "Restrict Enrollment Agents" on CA templates
• Monitor for Event ID 4886 (certificate enrollment) with unusual cdc/rmd attributes

Detection

Hunt for exploitation attempts using these indicators:

Windows Event Logs:

• Event ID 4886 (Certificate Services enrollment) with custom cdc/rmd attributes
• Event ID 4768 (Kerberos TGT request) with PKINIT from non-DC accounts
• Event ID 4624 (Logon) type 18 (PKINIT) for DC accounts from non-DC IPs

Network Traffic:

• LDAP/SMB connections from CA server to non-DC hosts on ports 389/445
• Certificate requests with cdc attribute pointing to non-DC hosts

Sigma Rule (basic):

YARA Rule (Certighost PoC artifact):

Frequently Asked Questions

Is this vulnerability exploitable without a domain account?

No. The attacker needs a valid domain user account (low privileges). However, any compromised endpoint with domain credentials is a valid starting point.

Does this affect Azure AD / Entra ID?

No. This is strictly on-premises AD CS. Azure AD / Microsoft Entra ID does not use AD CS for certificate enrollment.

Can I just disable AD CS?

If you don't use certificate-based authentication (smart cards, WiFi/EAP-TLS, VPN certs), you can uninstall the AD CS role. But most enterprises depend on it.

What if my CA is on a Domain Controller?

The exploit works regardless of whether the CA is on a DC or a dedicated server. The chase mechanism targets the DC's identity, not the CA's host.

How do I know if I've been compromised?

Check for:

• New machine accounts created recently (Event ID 4741)
• Certificate enrollments for DC accounts from non-admin users
• Unusual Kerberos PKINIT traffic
• DCSync-like replication traffic (Event ID 4662 with DS-Replication-Get-Changes)

Does the July 2026 Patch Tuesday fully fix this?

Yes. Microsoft's July 14, 2026 update (KB5041577 for Server 2022, KB5041579 for Server 2019) adds chase target validation. Apply immediately.

Key Takeaways

• CVE-2026-54121 (Certighost) is a critical AD CS privilege escalation to Domain Controller (CVSS 8.8)
• Public PoC exploit released July 27, 2026 — weaponization is now trivial
• Any authenticated domain user can achieve full domain takeover via DCSync
• Microsoft patched July 14, 2026; apply July Cumulative Updates immediately
• Workaround: Disable CDC chase via certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
• Hunt for anomalous certificate enrollments with cdc/rmd attributes and PKINIT abuse
• Reduce ms-DS-MachineAccountQuota to 0 as defense-in-depth

---

Sources:

• Microsoft MSRC CVE-2026-54121: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121
• Help Net Security: PoC exploit released for critical AD CS domain-takeover flaw (July 27, 2026)
• Certighost PoC Repository: https://github.com/aniqfakhrul/CVE-2026-54121
• Researcher Analysis: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
• Certipy (AD CS exploitation toolkit): https://github.com/ly4k/Certipy