A critical privilege escalation flaw in Active Directory Certificate Services (AD CS), tracked as CVE-2026-54121 and dubbed "Certighost," now has a public proof-of-concept exploit. Released on July 27, 2026, the PoC demonstrates how any authenticated domain user can escalate to Domain Controller privileges — and ultimately achieve full domain compromise — by abusing a fallback certificate enrollment mechanism.
Why This Matters to Developers and Security Teams
AD CS is the PKI backbone for thousands of enterprises. It issues certificates for smart card logon, VPN authentication, code signing, and Kerberos PKINIT. A vulnerability that lets a standard domain user obtain a DC certificate bypasses the entire trust model. If your environment runs AD CS (and most Windows domains do), this affects you.
The researchers (Aniq Fakhrul and Muhammad Ali) reported the bug to Microsoft in May 2026. Microsoft patched it in the July 2026 Patch Tuesday but initially assessed exploitation as "less likely." The public PoC changes that calculus — weaponization is now trivial.
Vulnerability Details: The CDC Chase Flaw
CVE-2026-54121 — CVSS 8.8 (High) — Improper Authorization in AD CS
| Attribute | Value |
|---|---|
| CVE | CVE-2026-54121 |
| CVSS 3.1 | 8.8 (High) |
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Component | Active Directory Certificate Services (Certification Authority) |
| Affected | Windows Server 2016, 2019, 2022 (all versions with AD CS role) |
| Patched | July 14, 2026 Patch Tuesday |
| PoC Released | July 27, 2026 |
The Attack Flow
- Attacker creates a machine account — Any domain user can create up to 10 machine accounts by default (
ms-DS-MachineAccountQuota). - Attacker sets up a rogue LDAP/SMB server — This "chase host" will respond to CA lookup requests.
- Attacker submits a certificate request with two custom attributes:
cdc(Client DC) — points to attacker's rogue hostrmd(Remote Domain) — specifies the target DC's machine account
- CA processes request — During enrollment, the CA fails to resolve the requester locally and falls back to "chasing" the
cdchost via SMB/LDAP. - Rogue host responds with the target DC's identity data — The CA trusts this because the chase host is a valid domain machine account.
- CA issues certificate for the target Domain Controller — Signed by the enterprise CA.
- Attacker uses PKINIT — The DC certificate enables Kerberos PKINIT authentication as the DC.
- DCSync attack — With DC credentials, attacker replicates
krbtgthash → Golden Tickets → full domain compromise.
Why the Chase Succeeds
The root cause is a fallback logic error. When the CA can't resolve the requester locally, it chases the cdc attribute. The CA validates the chase host by checking if it's a valid domain principal — which the attacker's machine account satisfies. The CA never verifies that the chase host is actually the Domain Controller it claims to represent.
Affected Systems
All supported Windows Server versions with the AD CS Certification Authority role installed:
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
Not affected: Standalone CAs (non-enterprise), or environments where AD CS is not installed.
Mitigation & Patching
1. Apply July 2026 Patch (Primary Fix)
Microsoft's July 14, 2026 updates add validation to the chase logic — the CA now verifies the chase target is a legitimate Domain Controller before proceeding.
2. Disable the CDC Chase (Immediate Workaround)
If you cannot patch immediately, disable the vulnerable code path entirely — the cdc chase is an optional fallback feature, not required for normal enrollment.
Note: This change takes effect immediately and requires no reboot beyond the service restart.
3. Reduce Machine Account Quota
Limit the default ms-DS-MachineAccountQuota from 10 to 0 (or a low value) to prevent users from creating the machine accounts needed for the attack.
Detection Rules
Suricata: Suspicious Certificate Request with CDC/RMD Attributes
alert tcp any any -> $DC_SERVERS 135 (
msg:"ET EXPLOIT Certighost CVE-2026-54121 Certificate Request with CDC/RMD";
flow:to_server,established;
content:"cdc"; nocase;
content:"rmd"; nocase;
threshold:type both, track by_src, count 1, seconds 60;
classtype:attempted-admin;
sid:2026003; rev:1;
metadata:created_at 2026-07-27;
)
YARA: Certighost PoC Binary Artifacts
Sigma: LDAP Queries for Target DC Machine Accounts
Frequently Asked Questions
Q: Are there CVEs for these findings?
A: CVE-2026-54121 is the assigned identifier. Microsoft published it on July 14, 2026.
Q: Does authentication protect me?
A: The attack requires a valid domain user account. Standard user + network access = vulnerable.
Q: Is my Azure AD / Entra ID affected?
A: No. This is strictly on-premises AD CS. Azure AD Kerberos and Cloud PKI are not vulnerable.
Q: What if I already patched in July?
A: You're protected. The July 2026 Patch Tuesday (KB5040442 for Server 2022) includes the fix.
Q: How do I know if I was compromised?
A: Check for unexpected RESTORE commands in CA logs, unusual XGROUP DELCONSUMER activity, unknown keys appearing, or outbound connections from DC hosts. The exploits leave traces in Windows Security logs (Event ID 4886, 4887 for certificate enrollment).
Q: What about managed PKI services?
A: If you use a hosted CA (e.g., Azure Certificate Manager, third-party managed PKI), contact your provider. They should have patched the underlying CA software.
Key Takeaways
- Any domain user can become Domain Admin via Certighost — patch AD CS misconfiguration.
- The July 2026 patch fixes it — but the CDC chase workaround is an instant mitigation.
- Machine account quota is a force multiplier — reduce
ms-DS-MachineAccountQuotato 0. - Detection is possible — monitor for certificate requests with
cdc/rmdattributes, LDAP queries targeting DC machine accounts, and PKINIT usage from non-DC hosts. - AD CS is a high-value target — treat it like a Tier 0 asset. Harden, monitor, and patch aggressively.
Conclusion
Certighost is a textbook example of how complex fallback logic in security-critical systems creates exploitable trust boundaries. The AD CS "chase" feature was designed for cross-forest enrollment scenarios, but its validation was insufficient. Microsoft's patch adds the missing check, but the workaround (disabling the chase) is simpler and safer for most environments.
If you run AD CS, apply the July 2026 patch today. If you can't patch today, run certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC and restart CertSvc right now. The PoC is public, exploitation is trivial, and the impact is total domain compromise.
Sources:
- Help Net Security: PoC exploit released for critical AD CS domain-takeover flaw CVE-2026-54121
- Microsoft Security Update Guide: CVE-2026-54121
- Certighost PoC Repository
- Researchers' Mitigation Gist
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.