Microsoft Fixes Certighost Flaw That Allowed Domain Controller Impersonation

Summary

Microsoft has addressed a critical vulnerability (CVE-2026-54121), dubbed Certighost, in Active Directory Certificate Services. This flaw allowed a low-privilege domain user to obtain a certificate impersonating a Domain Controller by tricking the Certification Authority into accepting attacker-controlled identity data. The exploit, demonstrated with a proof-of-concept, could lead to full domain compromise through techniques like DCSync.

Full text

Security MicrosoftMicrosoft Fixes Certighost Flaw That Allowed Domain Controller Impersonation Certighost allowed a low-privilege domain user obtain a valid Domain Controller certificate through AD CS. Microsoft patched the issue in the July security updates. byWaqasJuly 27, 20263 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening Microsoft has patched a high-severity vulnerability in Active Directory Certificate Services that allowed a user with basic domain access to obtain a valid certificate identifying them as a Domain Controller. Tracked as CVE-2026-54121 and named Certighost, the flaw received a CVSS score of 8.8. Researchers H0j3n and Aniq Fakhrul reported it to Microsoft in May 2026, and the company released a fix on July 14, 2026. Full technical details and a working proof of concept followed ten days later. Active Directory Certificate Services, commonly called AD CS, issues certificates that act as trusted digital identities inside company networks. Computers and users can present these certificates when requesting access to services, including Kerberos authentication. Certificate Authority Trusted the Wrong Server Certighost affects a fallback process called a “chase.” When a Certification Authority cannot resolve identity information during enrollment, it may contact another directory server to complete the lookup. A certificate request can contain a cdc value identifying the server to contact and an rmd value identifying the account or computer being requested. Before Microsoft’s update, the CA could follow the supplied address without first confirming that it belonged to a genuine Domain Controller. An attacker could point the CA toward a server they controlled and return identity data belonging to the target Domain Controller. The CA would then place the Domain Controller’s SID and DNS name inside a certificate issued to the attacker. Jason Soroko, senior fellow at certificate management provider Sectigo, said the cryptography itself did not fail. The signatures and certificate chain remained valid because the CA had signed the certificate correctly. The failure occurred earlier, when attacker-supplied directory information was accepted as proof of identity. In practice, the CA acted on information from the wrong source and then produced a genuine certificate containing a false identity. This also meant Microsoft’s strong SID binding, introduced after the Certifried vulnerability in 2022, could not stop the attack because the incorrect SID had already been written into the signed certificate. Proof of Concept Reached Domain Controller Access The researchers tested Certighost in an enterprise lab using an Enterprise CA, the default Machine certificate template, and an ordinary Domain Users account. Their exploit created a machine account, started the necessary directory services, and submitted the crafted certificate request automatically. After receiving the certificate, the script authenticated as the targeted Domain Controller and obtained a Kerberos credential for that account. Since Domain Controllers have directory replication rights, the researchers then used DCSync, a post-exploitation cyberattack technique, to retrieve account secrets, including the krbtgt credential used by Kerberos. Access to that credential can lead to full domain compromise because it can be used to create forged Kerberos tickets and impersonate other accounts. The attack required valid low-level domain credentials and network access to the CA, but it did not require administrator rights or action from another user. The demonstrated chain depended on specific conditions, including a vulnerable Enterprise CA following the chase path and certificate enrollment being available through the Machine template. The findings do not mean every Active Directory deployment could be compromised with the same steps. Vulnerable Chase flow Microsoft Adds Domain Controller Verification Microsoft’s July update has changed how the CA handles the requester-supplied server address. Before performing the chase, the CA now checks Active Directory to confirm that the supplied hostname belongs to a registered Domain Controller and later verifies that the resolved SID matches the expected identity. Organizations running AD CS should install the July 2026 security updates on every server hosting an issuing CA. Microsoft’s advisory lists affected Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Administrators unable to patch immediately can disable the Chase fallback using the policy setting documented by the researchers. They warned that this temporary measure was tested only in a lab and may disrupt legitimate certificate enrollment, making Microsoft’s update the recommended fix. Nevertheless, the good news is that no exploitation in real attacks had been reported when the technical details were published. However, a complete public exploit is now available, giving unpatched organizations less time to address the issue. Waqas I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cybersecurity and tech world. I am also into gaming, reading and investigative journalism. View Posts Aniq FakhrulCertighostChaseCyber AttackCybersecurityDomain ControllerH0j3nMicrosoftVulnerability Leave a Reply Cancel reply View Comments (0) Related Posts Read More Security Malware Nasty old Android malware with new capabilities gets difficult to remove This Android malware was identified in 2016 but in 2020 the malware is back with new capabilities including... bySudais Asif Read More Security Leaks 7 Million LifeBoat Accounts from Jan 2016 Breach Leaked Online Lifeboat has something to worry about — Perhaps it should inform users how the stolen 7 Million accounts from… byWaqas Read More Security Phishing Scam Facebook, Meta, Apple, Amazon Most Impersonated in Phishing Scams Feeling phished? Don't be a victim! Learn from Mailsuite's research which popular brands scammers impersonate the most (including surprising ones!) and how to identify these cunning attacks. byDeeba Ahmed Read More Cyber Attacks Malware Security Mirai Botnet Linked to Massive DDoS Attacks on Dyn DNS The DDoS attack on Dyn DNS was carried out using Mirai malware botnet — Mirai is a DDoS… byWaqas

Indicators of Compromise

• cve — CVE-2026-54121

Entities