Overview

Certighost is an Active Directory Certificate Services vulnerability disclosed on July 24, 2026 by researchers H0j3n and aniqfakhrul. It allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise, including DCSync and krbtgt extraction.

Patched in the July 2026 Patch Tuesday as CVE-2026-54121. If your Enterprise CA has not been updated, patch now.

  • CVE: CVE-2026-54121
  • Researchers: H0j3n, aniqfakhrul
  • Patched: July 14, 2026
  • Disclosed: July 24, 2026
  • Impact: Full domain compromise from low-privileged user
  • Affected component: Active Directory Certificate Services - Enterprise CA

Background

AD CS is Microsoft’s PKI implementation. It issues X.509 certificates used for authentication. A client requests a certificate from an Enterprise CA, then presents it to the KDC via PKINIT to obtain a Kerberos TGT.

If an attacker can obtain a certificate mapping to a Domain Controller identity, they can authenticate as that DC and abuse replication rights to extract domain secrets.

The Vulnerability: Enrollment Chase Fallback

The vulnerable path involves an AD CS enrollment behavior called a chase - a secondary directory lookup performed by the CA during cross-domain-controller enrollment scenarios.

Two request attributes control this:

  • cdc (Client DC) - the host the CA should contact
  • rmd (Remote Domain) - the principal the CA should look up

In the vulnerable configuration, the CA accepted these values without validating that cdc was actually a Domain Controller. An attacker could:

  1. Supply cdc pointing to an attacker-controlled host
  2. Supply rmd pointing to a real Domain Controller
  3. The CA connects to the attacker host over SMB and LDAP
  4. The attacker returns the DC objectSid and dNSHostName
  5. The CA issues a certificate with DC identity material
  6. The attacker authenticates as the DC via PKINIT and performs DCSync

The full chain is reachable by a low-privileged domain user using the default ms-DS-MachineAccountQuota setting.

Impact

A successful Certighost attack yields full domain compromise:

  • CA-signed certificate authenticating as a Domain Controller
  • Kerberos TGT for the DC account
  • DCSync - extraction of all domain hashes including krbtgt

What the July 2026 Patch Does

The patch adds a validation step in certpdef.dll before the CA follows any chase referral. The new function _ValidateChaseTargetIsDC checks:

  • Rejects empty values and hostnames over 260 characters
  • Rejects IPv4 and IPv6 literals
  • Rejects LDAP injection characters
  • Queries AD for a computer object with dNSHostName matching cdc AND userAccountControl including SERVER_TRUST_ACCOUNT (8192)
  • Requires exactly one matching DC object - if none found, request is rejected
  • Adds a SID verification step after resolution to prevent object substitution

After the patch, the chase target must be a real AD-registered Domain Controller.

Detection

Check if the July 2026 patch is installed on your CA server:

Get-HotFix -ComputerName <CA-ServerName> |
    Where-Object { $_.InstalledOn -gt (Get-Date "2026-07-01") } |
    Select-Object HotFixID, Description, InstalledOn |
    Sort-Object InstalledOn -Descending

Check ms-DS-MachineAccountQuota:

Get-ADObject -Identity ((Get-ADDomain).DistinguishedName) `
    -Properties ms-DS-MachineAccountQuota |
    Select-Object ms-DS-MachineAccountQuota

Hunt for suspicious certificate requests in CA logs:

Get-WinEvent -LogName "Security" -ComputerName <CA-ServerName> |
    Where-Object { $_.Id -eq 4886 -or $_.Id -eq 4887 } |
    Select-Object TimeCreated, Id, Message -First 50
  • Event ID 4886 - Certificate Services received a certificate request
  • Event ID 4887 - Certificate Services approved a certificate request

Mitigation

Priority 1 - Patch immediately. Apply the July 2026 Patch Tuesday update to all servers running the Enterprise CA role.

Priority 2 - Reduce ms-DS-MachineAccountQuota to 0 if domain users do not need to create machine accounts:

Set-ADDomain -Identity (Get-ADDomain).DistinguishedName `
    -Replace @{"ms-DS-MachineAccountQuota"="0"}

Priority 3 - Enable full CA audit logging:

certutil -setreg CA\AuditFilter 127
net stop certsvc
net start certsvc

Priority 4 - Review certificate template permissions. Audit which templates allow Domain Users or Authenticated Users to enroll, particularly machine templates.

Key Takeaways

  • A low-privileged domain user with default AD settings could achieve full domain compromise via AD CS - no special permissions required.
  • AD CS is a high-value target that deserves the same hardening attention as Domain Controllers.
  • Public PoC is available as of July 24, 2026. Treat this as an active threat.
  • Setting MachineAccountQuota to 0 is a low-risk hardening measure that removes a prerequisite for this and many other AD attacks.

References