How a Normal AD User Can Compromise an Entire Domain via the Certighost Vulnerability (CVE‑2026‑54121)

1. Vulnerability Overview

Certighost (CVE‑2026‑54121) was disclosed on July 24, 2026 after a ten‑week disclosure timeline. Microsoft released a patch on July 14, 2026, but the flaw is extremely easy to exploit.

Requires only a normal domain user account (member of Domain Users).

No administrator privileges are needed.

No victim interaction is required.

Exploitable on default configurations.

Impact Assessment

CVE ID: CVE‑2026‑54121

CVSS Score: 8.8 (High)

Vulnerability Type: Improper Authorization

Affected Systems: Windows Server 2012‑2025 (including Server Core), Windows 10 1607/1809

Prerequisites: Normal domain account + network‑reachable Enterprise CA

Result: Impersonate a domain controller → DCSync → Full AD domain takeover

After a successful attack the adversary obtains domain‑controller‑level identity, enabling DCSync to export all password hashes, extract the krbtgt key for golden ticket persistence, issue certificates for any user or machine, and retain complete control of the AD forest.

2. Technical Analysis: AD CS Chase Path Authentication Flaw

2.1 AD CS Basics – Certificates as Identity

Active Directory Certificate Services (AD CS) issues X.509 certificates that are used for encryption, signing, secure communication, and authentication. When a certificate is presented to the Key Distribution Center (KDC), the identity encoded in the certificate is mapped to an AD account; a successful mapping results in a Kerberos TGT. Consequently, whoever controls the certificate’s identity field controls the mapped account.

2.2 The Chase Mechanism

AD CS includes a “chase” fallback that, in cross‑domain controller certificate requests, may perform a second directory lookup based on two request attributes:

cdc (Client DC): the host the CA should contact.

rmd (Remote Domain): the principal the CA should look up.

If both attributes are present, the CA contacts the host specified by cdc via SMB/LDAP, retrieves the object identified by rmd, and uses the obtained identity data to build the certificate. The flaw is that the CA does **not** verify that the host indicated by cdc is actually the claimed domain controller.

2.3 Full Attack Chain

Step 1: Normal domain user creates a machine account (default MachineAccountQuota=10)
↓
Step 2: Attacker runs LDAP and LSA spoofing services on their machine
↓
Step 3: Submit a certificate request to the CA with cdc=attackerIP, rmd=targetDC
↓
Step 4: CA connects to attacker’s SMB/LDAP service; attacker returns real DC’s identity data
↓
Step 5: CA builds a certificate using the real DC’s objectSid and dNSHostName
↓
Step 6: Attacker uses the certificate with PKINIT to authenticate to the KDC, which believes the request comes from the DC
↓
Result: Attacker gains domain‑controller identity and can perform DCSync to obtain the krbtgt hash

The crucial element is the machine account acting as a trusted intermediary: the attacker‑controlled account passes the CA’s identity checks even though it is not the genuine domain controller.

2.4 Microsoft’s Fix

The July 14 update adds validation in CRequestInstance::_ValidateChaseTargetIsDC before the CA follows a chase:

Reject literal IP addresses – only DNS names are allowed.

Reject over‑long names and LDAP meta‑characters to prevent malformed input.

Require exact DNS name match to an AD computer object’s dNSHostName.

Validate the SERVER_TRUST_ACCOUNT flag (value 8192) on the computer object.

Perform SID comparison to prevent object substitution.

3. PoC Release

The Certighost exploitation tool, authored by security researchers H0j3n and Aniq Fakhrul, automates the entire chain from certificate request to DCSync.

PoC download: https://github.com/aniqfakhrul/CVE-2026-54121 Tool features:

Automatic discovery of enterprise CAs and target domain controllers.

Create or reuse machine accounts.

Launch SMB/LDAP listeners for relay attacks.

Submit certificate requests containing cdc / rmd attributes.

Export PFX certificates and Kerberos credential caches.

Support DCSync to directly dump the krbtgt hash.

Installation dependencies:

pip install --break-system-packages \
    git+https://github.com/fortra/impacket.git \
    cryptography pyasn1 asn1crypto pycryptodome dnspython

One‑click exploitation example:

python3 certighost.py \
    -d abc.local \
    -u normaluser -p '[PASSWORD]' \
    --dc-ip 192.168.8.128

After obtaining the domain‑controller certificate, the attacker can use PKINIT to get a TGT and then run secretsdump.py to perform DCSync and export the krbtgt hash, achieving persistent golden‑ticket access.

4. Detection and Defense

4.1 Immediate Remediation (Preferred)

Deploy the Microsoft July 14, 2026 security update on all AD CS servers. This is the only fully tested cure.

4.2 Temporary Mitigations

If patching is not possible, disable the chase fallback:

certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force

Warning: Disabling chase may break legitimate cross‑domain controller certificate requests; test in a lab first.

4.3 Detection Rules (Sentinel KQL)

MicrosoftWindows
| where EventID == 4886  // Certificate Services approved a certificate request
| where Param4 contains "Chase" or Param5 contains "CDC"
| project TimeGenerated, Computer, Subject, Param3, Param4, Param5
| order by TimeGenerated desc

4.4 Investigation Focus

Event ID 4886 – CA approved a request with chase attributes.

Unusual outbound LDAP/SMB connections from the CA to non‑DC addresses.

Spike in machine‑account creations within a short period.

DCSync activity originating from non‑DC hosts.

5. Closing Remarks

Certighost demonstrates that the most dangerous vulnerabilities often reside in seemingly innocuous features. The AD CS chase path, intended to simplify cross‑domain certificate requests, becomes a backdoor when authentication checks are missing. A single ordinary domain user, with just a joined machine and the default MachineAccountQuota, can impersonate a domain controller, extract the krbtgt key, and fully seize control of an AD forest. Red‑team operators see this as another classic AD CS exploitation chain following PetitPotam, Nightmare, and ESC8; blue‑team defenders must verify that their AD CS servers are patched and monitor for the indicators described above.