OFFSITE.DARK
← Signals

Jul 23, 2026

3 min

Sploitus

  • microsoft
  • adcs
  • active-directory
  • cve
  • certificate
  • kerberos
  • domain

news

Certighost: AD CS Chase Impersonation (CVE-2026-54121)

July 2026 AD CS chase fallback lets low-priv users coerce CA into issuing DC-identity certs; patched Patch Tuesday; public Certighost PoC indexed.

Summary

CVE-2026-54121 (“Certighost”) is an Active Directory Certificate Services improper-authorization flaw patched in July 2026 security updates. In vulnerable AD CS configurations, a low-privileged domain user could abuse the enrollment chase fallback — requester-controlled cdc (Client DC) and rmd (Remote Domain) attributes — so the CA contacts attacker-hosted SMB/LSA and LDAP listeners, accepts forged directory identity data for a Domain Controller, and issues a certificate usable for DC impersonation (PKINIT → Kerberos TGT / NT hash recovery in public demos).

Researchers @h0j3n and @aniqfakhrul published a detailed analysis (2026-07-24) and a public PoC tool indexed on Sploitus. OFFSITE.DARK indexes the advisory write-up and Sploitus card only.

Technical Details

AspectDetail
CVECVE-2026-54121
ComponentAD CS Enterprise CA — directory chase during enrollment
Root causeCA follows requester-supplied cdc without proving the host is a legitimate DC; uses returned objectSid / dNSHostName in issued identity
PrerequisitesDomain user + enrollable machine template; default ms-DS-MachineAccountQuota often sufficient to create a computer account for Netlogon-validated rogue services
OutcomeCertificate mapped to DC identity → certificate authentication / domain compromise in tested labs
FixJuly 2026 Microsoft security updates

High-level chase abuse (conceptual):

  1. Create or reuse a domain computer account.
  2. Host rogue LDAP + SMB/LSA listeners.
  3. Submit a cert request embedding cdc → attacker IP and rmd → target DC DNS name.
  4. CA authenticates to rogue services as the computer account, receives forged DC directory attributes.
  5. CA issues cert with DC identity material; attacker uses PKINIT against the KDC.

CVE

FieldValue
CVECVE-2026-54121
VendorMicrosoft — MSRC CVE-2026-54121
CVSS (Sploitus card)8.8
PatchJuly 2026 Patch Tuesday train
Public analysisGist — Certighost

Impact

Full domain compromise potential wherever Enterprise CA + vulnerable chase path + enrollable machine templates remain unpatched. Continues the AD CS abuse lineage (ESC series / Certipy ecosystem) with a new chase-target trust failure.

Mitigation

  1. Apply July 2026 Windows Server / AD CS-related updates on CAs and DCs.
  2. Audit AD CS for unusual chase traffic: CA initiating SMB:445 / LDAP:389 to non-DC hosts.
  3. Restrict who can enroll machine templates; lower ms-DS-MachineAccountQuota where operationally feasible.
  4. Monitor for sudden computer-account creation + certificate issuance spikes for DC-like SANs/SIDs.
  5. Treat public Certighost tooling as red-team/lab only; block unauthorized internal use.

Sources

→ Source