A working exploit dubbed Certighost was published on July 24 by researchers H0j3n and Aniq Fakhrul, demonstrating how a low-privileged Active Directory user can obtain a certificate for a Domain Controller and authenticate as that machine. The Certighost exploit targets a vulnerability in Active Directory Certificate Services that Microsoft patched ten days earlier as CVE-2026-54121.
Microsoft classified the flaw as improper authorization and assigned it a CVSS score of 8.8. Exploitation requires network access and a domain account, but no administrator rights or user interaction are necessary. Domain Controller accounts carry directory replication rights, meaning the resulting Kerberos credential can retrieve the krbtgt secret through DCSync attacks.
How Does the Certighost Attack Work?
The vulnerability resides in an AD CS enrollment fallback mechanism known as a chase. When a certification authority cannot obtain an end entity’s information, the Windows enrollment protocol allows a request to provide cdc (the Active Directory server to contact) and rmd (the machine object to resolve). The researchers discovered that the CA followed the requester-supplied cdc host over SMB and LDAP without first verifying it was a legitimate Domain Controller.
An attacker can run rogue Local Security Authority and LDAP services, relay the CA’s authentication challenge to the real Domain Controller over Netlogon, and return the target Domain Controller’s objectSid and dNSHostName. A controlled machine account supplies the valid domain identity needed for the CA to continue processing. The CA then authenticates that account and signs the target Domain Controller’s identity into the certificate.
What Are the Attack Requirements?
In the researchers’ testing, a normal Domain Users account could create a computer account under the default ms-DS-MachineAccountQuota value of 10 or reuse one already controlled. The attack chain also required an Enterprise CA following the vulnerable chain path, enrollment through the default Machine template, and network reachability from the CA to the attacker’s SMB and LDAP listeners.
The public exploit automates the entire chain, creating or reusing a computer account, starting listeners on ports 445 and 389, relaying the CA’s challenge to the real Domain Controller over Netlogon, and writing a PFX file and Kerberos credential cache. The exploit uses Public Key Cryptography for Initial Authentication in Kerberos to authenticate as the target Domain Controller.
What Did Microsoft’s Patch Address?
Binary analysis revealed that Microsoft’s July 14 update adds CRequestInstance::_ValidateChaseTargetIsDC to certpdef.dll before the CA follows a chase. The validation rejects IP literals, overlong names, and LDAP metacharacters. It requires exactly one matching Active Directory computer object whose DNS name matches the target and whose userAccountControl includes SERVER_TRUST_ACCOUNT (8192). A subsequent SID comparison blocks object substitution.
How Can Organizations Protect Themselves?
Organizations running an Enterprise CA should install Microsoft’s July 14 updates on AD CS hosts immediately. As of July 24, no primary source reported exploitation in the wild, though the full proof-of-concept was public. The researchers reported the flaw to Microsoft on May 14, Microsoft confirmed it on May 22, and patched it on July 14 before the public disclosure on July 24.
Administrators who cannot patch immediately can disable the chase fallback by clearing the chase flag and restarting Certificate Services, though the researchers warn this mitigation was tested only in a controlled lab environment and may break legitimate enrollment flows. The flaw was absent from CISA’s Known Exploited Vulnerabilities catalog on July 24.
Source: The Hacker News