A proof-of-concept (PoC) exploit has been publicly released for CVE-2026-54121, a critical privilege elevation vulnerability in Active Directory Certificate Services (AD CS) that can lead to a complete domain takeover. The flaw, nicknamed Certighost by the researchers who discovered it, carries a CVSS score of 8.8 and affects all supported versions of Windows Server that run the AD CS role.
Understanding AD CS and the Vulnerability
Active Directory Certificate Services is a Windows Server role that enables organizations to deploy their own Public Key Infrastructure (PKI). It acts as a Certificate Authority (CA), issuing and managing digital certificates used for authentication, encryption, and signing across the network. AD CS is often used to support smart card logon, secure email, digital signatures, and the encryption of data with services such as Encrypting File System (EFS).
CVE-2026-54121 is an improper authorization vulnerability in the enrollment process of AD CS. Specifically, it lies in how the CA handles cross-domain controller certificate requests. During enrollment, the CA must resolve the identity of the requester by looking up a directory object. In certain scenarios, the CA may perform a secondary directory lookup by contacting another host—this is known as a 'chase'. Two attributes in the certificate request, cdc (Client DC) and rmd (Remote Domain), can steer this chase to an attacker-controlled host.
When both attributes are present, the CA opens SMB and LDAP connections to the host specified in cdc, searches for the principal named in rmd, and uses whatever identity data it receives while building the certificate. An authenticated attacker with a domain account can manipulate these attributes to trick the CA into issuing a certificate for a target Domain Controller.
Exploitation Details
The exploit, detailed by researchers Aniq Fakhrul and Muhammad Ali, relies on the fact that a machine account created using the default ms-DS-MachineAccountQuota setting is a valid domain principal. This allows the attacker-controlled chase host to pass the CA's authentication checks, even though it is not the actual Domain Controller being impersonated. The PoC exploit demonstrates how an attacker can obtain a CA-signed certificate that authenticates as a target Domain Controller.
Using this certificate, the attacker can perform PKINIT (Public Key Cryptography for Initial Authentication in Kerberos) to request Kerberos credentials for the Domain Controller account. Once authenticated as a Domain Controller, the attacker gains directory replication rights. This enables a DCSync attack, where the attacker can request the password hashes of all domain accounts, including the krbtgt account. Compromising the krbtgt secret allows the attacker to forge Kerberos tickets and maintain persistent, stealthy access to the domain.
Historical Context and Similar Vulnerabilities
This is not the first critical vulnerability discovered in Active Directory Certificate Services. In the past, researchers have uncovered several other attack vectors, including the notorious ESC1-ESC8 flaws in 2021, and PetitPotam in 2021, which allowed attackers to force a Windows server to authenticate over SMB to an attacker-controlled system. The Certighost vulnerability is another chapter in the ongoing saga of AD CS weaknesses, highlighting the complexity and risk of this widely deployed service.
The researchers reported the bug to Microsoft in May 2026. Microsoft released security updates as part of its July 2026 Patch Tuesday, addressing CVE-2026-54121 and several other vulnerabilities. At the time, Microsoft assessed the exploitability as 'less likely', but that assessment is now likely to change given the public availability of the PoC exploit.
Mitigation and Patching
Administrators are strongly urged to apply the July 2026 security updates on all affected AD CS hosts as soon as possible. For those who cannot immediately install the patches, a registry flag can disable the chase functionality entirely. This can be done using the following command:
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
After modifying the registry, the CA service must be restarted with:
Restart-Service CertSvc -Force
This workaround disables the optional fallback feature that the exploit leverages. However, it may impact legitimate cross-domain controller enrollment scenarios, so thorough testing is recommended before deployment in production environments.
Impact and Recommendations
The impact of successful exploitation is severe: full domain compromise. An attacker who exploits CVE-2026-54121 can effectively become the domain administrator, able to read, modify, or delete any Active Directory object, reset passwords, and gain access to all resources protected by the domain. The attack does not require any user interaction beyond the initial authentication.
Organizations should prioritize patching critical infrastructure such as Domain Controllers and Certificate Authorities. Monitoring for unusual certificate enrollment requests, especially those containing suspicious cdc or rmd attributes, can help detect early signs of exploitation.
To date, no evidence of exploitation in the wild has been reported. However, with the public release of the PoC exploit, that situation may change rapidly. Network defenders should remain vigilant and consider this vulnerability a high priority for remediation.
Source: Help Net Security News