'Certighost' Flaw in Microsoft AD CS Allows Domain Compromise
A critical vulnerability in Microsoft Active Directory Certificate Services (AD CS), dubbed CertiGhost, has been patched, enabling unauthenticated attackers to escalate privileges and potentially achieve full domain compromise.
Microsoft has addressed a critical vulnerability within its Active Directory Certificate Services (AD CS) that allowed attackers to escalate privileges and potentially gain complete control over a network domain. The flaw, discovered by researchers Aniq Fakhrul and Muhammad Ali and named 'Certighost,' was patched as part of Microsoft's July 2026 Patch Tuesday updates.
The vulnerability, tracked as CVE-2026-54121, exploited a weakness in AD CS's handling of a certificate enrollment fallback mechanism known as a "chase." This mechanism is used in specific cross-domain controller enrollment scenarios. Researchers found that by manipulating certain request attributes, an attacker could trick the Certificate Authority (CA) into querying an attacker-controlled host for identity information belonging to a Domain Controller. The CA would then use this compromised data to issue a certificate.
This exploit chain leveraged a broken trust boundary within the AD CS certificate enrollment process. Normally, Active Directory relies on its own directory as the definitive source of truth for identity. However, the Certighost flaw allowed a low-trust party to direct a high-trust component, the CA, to a compromised source for identity data without proper validation. This effectively enabled an attacker to impersonate a domain controller by presenting a certificate issued based on falsified information.
Active Directory Certificate Services are Microsoft's implementation of a public key infrastructure (PKI) that integrates with Active Directory. It is responsible for issuing X.509 certificates used for various security functions, including encryption, digital signatures, and secure authentication. Certificates bind a subject's identity to a public key, with the CA vouching for the validity of this binding.
The researchers demonstrated a proof-of-concept (PoC) exploit in a lab environment. The attack involved a low-privileged domain user account, an Enterprise CA, and Windows Server Active Directory. The PoC script, written in Python, first gathered necessary network information via LDAP, then created a machine account, and subsequently started local LSA and LDAP services. These services relayed the CA's authentication challenge to the legitimate domain controller, allowing the attacker's controlled host to be accepted as a valid domain principal during the certificate issuance process.
Once the CA was successfully tricked into issuing a certificate containing identity material for the target Domain Controller, the attacker could use this certificate to authenticate as the compromised domain controller. This granted them the ability to write to the resulting credential cache, effectively achieving domain compromise. The researchers noted that this type of vulnerability, where a component follows a pointer from a low-trust party to a high-trust target without sufficient validation, is a recurring pattern seen in various protocols.
The researchers responsibly disclosed the vulnerability to Microsoft on May 14, 2026. Microsoft confirmed the flaw by May 22 and released the patch in its July Patch Tuesday updates. The company acknowledged the researchers' efforts in its advisory. While the vulnerability is now patched, organizations are urged to ensure their AD CS environments are updated to prevent potential exploitation of this critical flaw.
This incident highlights the ongoing risks associated with Active Directory Certificate Services, a critical component for many enterprise security infrastructures. The ability for an unauthenticated attacker to escalate privileges to domain administrator levels underscores the importance of timely patching and robust security monitoring for AD CS deployments.