Microsoft has patched a serious flaw in Active Directory Certificate Services (AD CS), the Windows
service that issues the digital certificates used to prove identity across a network. The flaw, nicknamed
Certighost, lets an attacker who holds only an ordinary staff login trick the certificate service into issuing
a certificate for a Domain Controller, one of the servers that runs the whole Windows network, which
hands the attacker full control of the domain. A fix shipped on 14 July 2026, and a working attack tool
was made public on 24 July 2026, so any unpatched certificate server should be updated straight
away.
1. Vulnerability Details
CVE ID – CVE-2026-54121
CVSS SCORE – 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EXPLOIT STATUS – Patched 14 July 2026. Public proof-of-concept released 24 July 2026. No confirmed
exploitation in the wild. Microsoft assesses exploitation less likely, with exploit code maturity Unproven and report confidence Confirmed.
Microsoft classifies this as CWE-285 (Improper Authorization). AD CS certificate enrollment includes a fallback lookup, the chase, that resolves a requester’s identity across domain controllers. Two request attributes steer it: cdc names the host the Certification Authority contacts, and rmd names the principal it looks up. The vulnerable Certification Authority accepted the requester-supplied cdc target without proving it was a real Domain Controller, then trusted the identity data it received over SMB and LDAP while building the certificate. A machine account created through the default ms-DS MachineAccountQuota is a valid domain principal, so an attacker-controlled host passed the checks needed to continue.
2. Affected Products
- Active Directory Certificate Services role on Windows Server 2012 and 2012 R2, including Server Core, before the July 2026 update.
- AD CS role on Windows Server 2016, 2019, 2022, and 2025, including Server Core, before the July 2026 update.
- Windows 10 version 1607 and version 1809 (x64 and 32-bit) before the July 2026 update.
- Fixed by the 14 July 2026 security update, which validates the cdc chase target against the directory and adds a SID check.
3. Observed Activity
The public proof-of-concept runs the full chain in one process from a single low-privileged domain account. No administrator rights and no user interaction are required.
- Enrollment abuse: The attacker creates a machine account through ms-DS-MachineAccountQuota, starts rogue LDAP and LSA listeners, and submits a certificate request whose cdc attribute points to the attacker host and whose rmd attribute names the target Domain Controller.
- Domain Controller impersonation: The Certification Authority chases to the rogue host, which returns the target Domain Controller’s SID and DNS hostname. The CA issues a certificate carrying that Domain Controller’s identity.
- Domain compromise: The attacker uses the certificate with PKINIT to obtain Kerberos credentials for the Domain Controller account, then runs DCSync to extract the krbtgt secret, reaching full domain compromise.
- Disclosure timeline: Reported to Microsoft on 14 May 2026 and confirmed on 22 May 2026. Patched on 14 July Public proof-of-concept and technical write-up released on 24 July 2026 by Aniq Fakhrul and Muhammad Ali.
- Post-update behaviour: The July 2026 update makes the CA confirm the cdc target resolves to a genuine Domain Controller computer object before the chase, and compares the resolved SID. The chase is an optional fallback that can also be turned off by policy.
4. Adversary Toolkit
| Tool | Language | Function |
| certiqhost.py | Python (Impacket) | A public proof-of-concept (PoC) tool that creates a machine account, launches rogue LDAP and SMB listeners, and requests a Domain Controller (DC) certificate. |
| Certipy | Python | An Active Directory Certificate Services (AD CS) enumeration and exploitation toolkit that requests and forges certificates, and authenticates using PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). |
5. Recommendations
- Find every Active Directory Certificate Services host running a Certification Authority, and confirm whether the July 2026 security update is installed on each.
- Apply the July 2026 Windows update to all Certification Authority hosts. It validates the chase target against the directory before a certificate is issued.
- If you cannot patch at once, turn off the optional cdc chase fallback: run certutil -setreg policy\EditFlags EDITF_ENABLECHASECLIENTDC, then Restart-Service CertSvc -Force.
- Lower ms-DS-MachineAccountQuota to 0 so standard domain users cannot create the machine accounts this attack relies on.
- Hunt for Certification Authority hosts opening SMB and LDAP connections to non-Domain-Controller hosts, and for certificate requests carrying cdc and rmd attributes.
6. Sources
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121
- https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
- https://github.com/aniqfakhrul/CVE-2026-54121
- https://github.com/ly4k/Certipy
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.
