Certighost Flaw Allows Low-Privilege AD Users to Impersonate Domain Controllers
A critical Active Directory vulnerability enables non-admin users to obtain Domain Controller certificates and escalate privileges.
1Discovery of Certighost
Researchers H0j3n and Aniq Fakhrul uncovered a flaw letting low-privileged Active Directory users obtain Domain Controller certificates. Dubbed 'Certighost', this vulnerability allows acquiring Kerberos credentials for DCSync attacks. Microsoft patched it as CVE-2026-54121 on July 14, but full PoC was published on July 24.
2Attack Mechanics
The attack begins when an Enterprise CA follows vulnerable chain paths. Attackers run rogue LSA/LDAP services, relaying CA's authentication challenge to genuine DCs via Netlogon to harvest objectSid and dNSHostName. Controlled machine accounts provide valid domain identities needed for CA to issue forged certificates.
3Impact Scope
Tested on Windows Server 2016+ forests with Enterprise CA, but NVD lists all versions from Server 2012 to 2025 as vulnerable, including Server Core. Windows 10 versions 1607 and 1809 are also affected. While absent from CISA's KEV catalog, the public exploit significantly raises threat levels.
4Microsoft's Response
Microsoft confirmed the bug on May 22 after researchers' May 14 report, releasing patches on July 14. The update adds CRequestInstance::_ValidateChaseTargetIsDC function, rejecting IP literals, long names, LDAP metacharacters, and requiring exact DNS-matched computer objects with SERVER_TRUST_ACCOUNT flag.
5Interim Mitigation
For organizations unable to patch immediately, researchers suggest clearing chase flags and restarting Certificate Services using: 'certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC' followed by 'Restart-Service CertSvc -Force'. This workaround was only lab-tested, with July updates being the permanent solution.
6Urgent Action Required
Certighost presents a privilege escalation vector with potential domino effects in enterprise networks. With public exploit code available, threat actors now have a turnkey tool. IT teams must urgently patch all Enterprise CA-running AD CS servers and monitor for abnormal certificate requests through network detection systems.