Certighost (CVE-2026-54121): Any Domain User Could Impersonate a Domain Controller

Researchers H0j3n and Aniq Fakhrul have published a working exploit for a flaw they codenamed Certighost, tracked as CVE-2026-54121. It lets a low-privileged, already-authenticated Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine — a serious escalation path in environments running Active Directory Certificate Services (AD CS).

A fallback nobody validated

The root cause sits in an AD CS enrollment fallback known as a chase. When a certificate authority can't resolve an end entity's identity directly, the Windows enrollment protocol lets a request supply its own hints: cdc (the Active Directory server to contact) and rmd (the machine object to resolve). According to cybersecuritynews.com, the vulnerable CA code trusted whatever host was supplied in cdc without first confirming it was an actual Domain Controller.

From a rogue LDAP relay to krbtgt

• A domain user registers one or more machine accounts, something the default ms-DS-MachineAccountQuota setting permits for any authenticated user.
• The attacker stands up rogue SMB, LDAP and LSA services and points the CA's chase lookup at their own host via the cdc/rmd parameters.
• Those rogue services return fabricated identity data, and the CA's authentication challenge gets relayed to a real Domain Controller over Netlogon.
• The attacker's controlled machine account validates the forged response, and the CA issues a certificate carrying the target DC's SID and hostname.
• That certificate authenticates via PKINIT as the Domain Controller — and because DC accounts hold directory replication rights, the attacker can run DCSync to extract the krbtgt secret.

Owning krbtgt is one of the most damaging outcomes in an AD compromise: it lets an attacker forge Kerberos tickets (a 'Golden Ticket') and persist even after passwords are reset, effectively controlling the domain.

Who's affected and what to do

The flaw affects Enterprise CAs with default Machine certificate templates and was reported to Microsoft earlier this year, with a fix shipped in the July 2026 security update. Microsoft's patch adds a _ValidateChaseTargetIsDC check that rejects IP literals and LDAP metacharacters in chase parameters and confirms the resolved object actually carries the SERVER_TRUST_ACCOUNT flag before the CA trusts it, per TheHackerNews.

With a public exploit now available, patching AD CS servers is the priority. Where patching can't happen immediately, disabling the chase fallback via certutil is a stopgap, though it can break legitimate enrollment workflows that depend on it — treat it as a temporary measure, not a fix. Either way, this is a good moment to review Machine template permissions and ms-DS-MachineAccountQuota settings, since the exploit also leans on the default ability of ordinary users to register machine accounts.

Why this matters beyond one patch

Certighost is another entry in a growing list of AD CS abuse paths (alongside the well-known ESC1–ESC8 family) where certificate-based authentication becomes a shortcut around normal privilege boundaries. AD CS deployments are common, often misconfigured, and rarely monitored as closely as domain group memberships — which is exactly why they keep surfacing as a preferred escalation route in real intrusions and red-team engagements alike.