Certighost Exploit Allows Low-Privileged Users to Impersonate Domain Controllers
A newly disclosed exploit, codenamed Certighost, enables low-privileged Active Directory users to impersonate a Domain Controller, retrieve sensitive credentials, and gain elevated access.
Researchers have developed and released a working exploit for a critical flaw in Microsoft's Active Directory Certificate Services (AD CS), dubbed Certighost. This vulnerability allows a user with minimal privileges within an Active Directory environment to obtain a certificate for a Domain Controller and subsequently authenticate as that machine. The exploit chain leverages the inherent directory replication rights of Domain Controller accounts to facilitate the retrieval of the highly sensitive krbtgt secret through a technique known as DCSync.
Microsoft had previously addressed this improper authorization flaw, identified as CVE-2026-54121, in its July 14th security updates, assigning it a CVSS score of 8.8. The exploitation process requires network access and a valid domain account, but notably does not necessitate administrator privileges or any form of user interaction. In testing scenarios, a standard Domain Users account was capable of creating a new computer account or reusing an existing one, provided the default ms-DS-MachineAccountQuota value was met or the attacker already controlled a suitable account.
Successful exploitation hinges on several prerequisites: the presence of an Enterprise Certificate Authority (CA) configured with a vulnerable chain path, the ability to enroll using the default Machine certificate template, and network reachability from the CA to the attacker's controlled SMB and LDAP listeners. The vulnerability lies within an AD CS enrollment fallback mechanism known as a 'chase.' When a CA cannot initially ascertain an end entity's details, the Windows enrollment protocol permits the request to specify a cdc (the Active Directory server to contact) and rmd (the machine object to resolve).
The researchers discovered that the CA would proceed to contact the requester-supplied cdc host over SMB and LDAP without first verifying if it was a legitimate Domain Controller. An attacker could exploit this by running rogue Local Security Authority (LSA) and LDAP services. They could then relay the CA's authentication challenge to the actual Domain Controller, capture the target Domain Controller's objectSID and dNSHostName, and use a controlled machine account to provide a valid domain identity. The CA would authenticate this account and then issue a certificate impersonating the target Domain Controller.
The public proof-of-concept exploit automates this entire process. It can create a new computer account or utilize a pre-existing one. The tool then initiates listeners on ports 445 (SMB) and 389 (LDAP) and relays the CA's authentication challenge to the legitimate Domain Controller via Netlogon. Subsequently, it submits the cdc and rmd attributes, ultimately generating a PFX file and a Kerberos credential cache.
With the forged Kerberos credential, an attacker can leverage the PKINIT (Public Key Cryptography for Initial Authentication in Kerberos) protocol to authenticate as the compromised Domain Controller. This elevated access allows them to request sensitive account secrets, including the krbtgt hash, via DCSync, effectively granting them domain-wide control.
Microsoft's July update addresses this by introducing CRequestInstance::_ValidateChaseTargetIsDC in certpdef.dll. This validation checks reject IP literals, overly long names, and LDAP metacharacters, and crucially requires a single matching Active Directory computer object whose DNS name aligns with the target and possesses the SERVER_TRUST_ACCOUNT flag. A subsequent SID comparison further prevents object substitution.
While no exploitation in the wild had been reported as of the article's publication, the public availability of the exploit code significantly increases the risk. Organizations running an Enterprise CA are strongly advised to apply Microsoft's July security updates to their AD CS hosts immediately. As a temporary mitigation for those unable to patch promptly, administrators can disable the chase fallback by clearing the chase flag and restarting the Certificate Services, though this may disrupt legitimate enrollment processes.
The vulnerability, CVE-2026-54121, was patched by Microsoft in their July 2026 security updates. The patch introduces a new validation function, _ValidateChaseTargetIsDC, which verifies that the target specified in the chase attribute is a legitimate Domain Controller before issuing a certificate. For organizations unable to patch immediately, a temporary mitigation involves disabling the chase fallback via the certutil command.