Certighost: An Ordinary AD User Can Impersonate a Domain Controller

On July 24, researchers H0j3n and Aniq Fakhrul released a working exploit that lets an unprivileged Active Directory user obtain a domain controller certificate and authenticate as that machine. Because domain controller accounts are granted directory replication rights, the Kerberos credentials obtained this way make it possible to extract the krbtgt secret through DCSync — which is effectively the keys to the entire domain.

Microsoft had already closed the vulnerability, dubbed Certighost, ten days earlier — on July 14 — under the identifier CVE-2026-54121. The company classified it as improper authorization and assigned it a CVSS score of 8.8. Exploitation requires network access and a domain account, but neither administrator rights nor user interaction.

Where the flaw lies

The problem lives in AD CS's fallback mechanism for retrieving data when issuing certificates, known as chase. When the certification authority cannot obtain information about the requesting party on its own, the protocol lets the request specify which Active Directory server to contact and which machine object to resolve. The researchers found that the CA obediently followed the address given in the request over SMB and LDAP, without first verifying whether it was actually facing a genuine domain controller.

The attacker stands up spoofed LSA and LDAP services, relays the CA's authentication request to the real domain controller via Netlogon, and returns the target's requested attributes. A machine account under their control supplies the valid domain identity the certification authority needs to proceed. As a result, the CA writes the domain controller's identity into the certificate. By default the machine account creation quota (ms-DS-MachineAccountQuota) is ten, so nothing prevents an ordinary user from creating the required account themselves.

Scope and countermeasures

The public exploit fully automates the chain: it creates or reuses a computer account, starts listeners on ports 445 and 389, relays the request, and on output writes a PFX file and a Kerberos credential cache using PKINIT. Testing was carried out in a forest based on Windows Server 2016 and newer with an enterprise CA and the default Machine certificate template. The NVD entry additionally lists versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809.

Organizations with an enterprise CA deployed are advised to install the July updates on their AD CS hosts. The patch adds a CRequestInstance::_ValidateChaseTargetIsDC check that rejects IP addresses, overly long names and LDAP metacharacters, and also requires the presence of exactly one computer object with the SERVER_TRUST_ACCOUNT flag followed by a SID comparison.

As of July 24, no verified primary source had reported attacks in the wild, and the vulnerability was absent from CISA's KEV catalog. However, a full-fledged proof-of-concept has already been published, and the lack of reports does not prove that exploitation has not occurred. For those who cannot update immediately, the authors described a way to disable the chase mechanism, cautioning that they had tested it only in a lab and that it may break legitimate certificate issuance.

Source: The Hacker News