Security researchers published a working proof of concept for Certighost, an Active Directory Certificate Services flaw that let a low-privileged domain user impersonate a domain controller in the tested configuration. The chain directed a certification authority to attacker-controlled directory services, returned identity data for a real domain controller, and obtained a CA-signed certificate that could be used for Kerberos authentication and DCSync.
Microsoft addressed CVE-2026-54121 in its July 14 security updates and rates it 8.8. The vendor describes the issue as improper authorization that permits an authorized attacker to elevate privileges over a network. Microsoft has not reported active exploitation. The public disclosure and proof of concept establish a practical route to domain compromise where the required AD CS conditions exist.
A requester chose where the CA looked up identity
The flaw sat in an AD CS enrollment fallback called a directory chase. According to the researchers’ July 24 technical disclosure, two request attributes influenced the lookup. cdc named the host that the CA should contact, while rmd named the principal it should resolve.
Before the update, the CA could follow the requester-supplied cdc value over SMB and LDAP without first proving that the target was a domain controller. The attacker’s rogue services used a valid machine account to satisfy the domain authentication checks, then answered the CA’s lookup with the target domain controller’s SID and DNS name. The CA used those returned values while building the certificate.
The proof-of-concept repository automates the chain. It creates or reuses a machine account, runs rogue LDAP and LSA services, submits the crafted request, receives a certificate for the target domain controller, and uses PKINIT to obtain Kerberos credentials. A domain controller account has directory replication rights, which allowed the researchers to retrieve the krbtgt secret with DCSync in their lab.
Figure details
A low-privileged domain user submits a certificate request whose cdc attribute points to a rogue host and whose rmd attribute names a target domain controller. The certification authority follows cdc over SMB and LDAP. The rogue services authenticate with a valid machine account through the real domain controller, then return the target domain controller's SID and DNS name. The CA issues a certificate containing that identity material. The certificate authenticates through PKINIT as the domain controller, and the resulting credential can request directory replication through DCSync. The July update validates that cdc resolves to a real domain controller in Active Directory and compares the resolved SID before the chase continues.
Enterprise CA settings determine exposure
The researchers demonstrated Certighost with an enterprise CA, a low-privileged user allowed to enroll through the default Machine certificate template, and the default ms-DS-MachineAccountQuota value of 10. The chase fallback also had to be available. Those prerequisites narrow exposure, but each is common enough that a Windows inventory alone cannot answer whether a forest was reachable through this path.
The public record does not establish that every enterprise CA or template combination is exploitable. It also does not show attacks outside the researchers’ lab. Defenders should inventory the CA, templates, enrollment permissions, machine-account creation policy, and chase setting rather than infer safety from the absence of an internet-facing service.
July updates verify the chase target before trusting its answer
The researchers compared June and July versions of the AD CS policy module. The updated path checks whether cdc resolves in Active Directory to exactly one computer object marked as a domain controller. It rejects IP literals and unsafe hostname characters, then performs a later SID comparison before allowing the chase to continue. A failed check takes the request to an error path.
The disclosure also describes a temporary mitigation for a CA that cannot be patched immediately: disable the chase fallback by clearing EDITF_ENABLECHASECLIENTDC and restart Certificate Services. The researchers validated that change only in a controlled lab and warn that legitimate cross-domain enrollment can fail when the fallback is disabled. The July security update remains the recommended remediation.
Defenders should close the certificate and replication paths
Apply the July update to every enterprise CA that can issue authentication certificates. Verify the update on the CA itself, then confirm the protected chase behavior is active. If an emergency mitigation is required, test the affected enrollment paths in staging before disabling the chase fallback, and record the exact policy state after the Certificate Services restart.
Preserve the CA database and security logs before changing the system. Microsoft’s certutil -view can export the issued-certificate log and request-attribute table. Review the relevant retention window for cdc and rmd attributes, machine-account requesters, and certificates carrying a domain controller SID or DNS identity that do not match an expected enrollment. Certificate Services audit events 4886 and 4887 record received and issued requests when that auditing was enabled.
Treat a suspicious domain controller certificate as a domain compromise investigation. Revoke the certificate, contain the requester and machine account, and correlate the issuance time with Kerberos and replication evidence. Microsoft Defender for Identity’s DCSync alert identifies directory replication requests and records the source address. A request from a system that is not an approved domain controller requires immediate investigation.
Close the incident only when every CA is patched or the chase is disabled, the issuance and attribute records show no unexplained domain controller certificate, suspicious certificates and accounts are contained, and replication telemetry shows no unauthorized source. Missing CA records, disabled auditing, or absent replication coverage leaves the exposure unresolved rather than clean.