Full Report
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.
Analysis Summary
# Vulnerability: Certighost (AD CS Improper Authorization)
## CVE Details
- **CVE ID:** CVE-2026-54121
- **CVSS Score:** 8.8 (High)
- **CWE:** Improper Authorization
## Affected Systems
- **Products:** Microsoft Windows Server and Windows 10
- **Versions:**
- Windows Server 2012 through Windows Server 2025 (including Server Core)
- Windows 10 versions 1607 and 1809
- **Configurations:**
- Environments running an Enterprise Certification Authority (CA).
- Environments using the default Machine certificate template.
- Active Directory forests where `ms-DS-MachineAccountQuota` is set to the default (10) or higher.
- Network reachability from the CA to the attacker's SMB/LDAP listeners.
## Vulnerability Description
The vulnerability exists in the Active Directory Certificate Services (AD CS) enrollment "chase" fallback mechanism. When a CA cannot resolve an end entity's information, the Windows enrollment protocol allows a request to specify a Domain Controller (`cdc`) and a machine object (`rmd`) to resolve.
The flaw allows an attacker to provide a rogue `cdc` host. The CA connects to this host via SMB and LDAP without prior validation. An attacker can relay the CA's authentication challenge to a legitimate Domain Controller via Netlogon, spoofing the identity of a Domain Controller. The CA then incorrectly signs the target Domain Controller's identity into a certificate issued to the attacker.
## Exploitation
- **Status:** PoC available (Published July 24, 2026)
- **Complexity:** Medium
- **Attack Vector:** Network
- **Note:** Requires a low-privileged domain account but no administrative rights or user interaction.
## Impact
- **Confidentiality:** High (Allows retrieval of `krbtgt` secrets via DCSync)
- **Integrity:** High (Full impersonation of a Domain Controller)
- **Availability:** High (Potential for total domain compromise)
## Remediation
### Patches
- Install the **July 14, 2026** security updates provided by Microsoft for all affected Windows Server and AD CS hosts. This update introduces `CRequestInstance::_ValidateChaseTargetIsDC` to validate that the target of a chase is a legitimate Domain Controller.
### Workarounds
- Disable the chase fallback mechanism (requires testing as it may interrupt legitimate enrollment flows).
- Set `ms-DS-MachineAccountQuota` to `0` to prevent low-privileged users from creating new computer accounts.
## Detection
- **Indicators of Compromise:**
- Unusual SMB or LDAP traffic originating from a CA toward non-DC internal hosts or low-privileged workstations.
- Creation of unexpected machine accounts by low-privileged users.
- Certificate enrollment requests using the default Machine template with specific `cdc` and `rmd` attributes.
- **Detection Methods:** Monitor for `DCSync` activity from unexpected machine accounts and audit AD CS enrollment logs for evidence of "chase" resolution.
## References
- **Vendor Advisory:** [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121)
- **NVD Entry:** [https://nvd.nist.gov/vuln/detail/CVE-2026-54121](https://nvd.nist.gov/vuln/detail/CVE-2026-54121)
- **Researcher PoC:** [https://github.com/aniqfakhrul/CVE-2026-54121](https://github.com/aniqfakhrul/CVE-2026-54121)
- **Technical Analysis:** [https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html](https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html)