- microsoft
- adcs
- active-directory
- cve
- certificate
- kerberos
- domain
news
Certighost: AD CS Chase Impersonation (CVE-2026-54121)
July 2026 AD CS chase fallback lets low-priv users coerce CA into issuing DC-identity certs; patched Patch Tuesday; public Certighost PoC indexed.
Summary
CVE-2026-54121 (“Certighost”) is an Active Directory Certificate Services improper-authorization flaw patched in July 2026 security updates. In vulnerable AD CS configurations, a low-privileged domain user could abuse the enrollment chase fallback — requester-controlled cdc (Client DC) and rmd (Remote Domain) attributes — so the CA contacts attacker-hosted SMB/LSA and LDAP listeners, accepts forged directory identity data for a Domain Controller, and issues a certificate usable for DC impersonation (PKINIT → Kerberos TGT / NT hash recovery in public demos).
Researchers @h0j3n and @aniqfakhrul published a detailed analysis (2026-07-24) and a public PoC tool indexed on Sploitus. OFFSITE.DARK indexes the advisory write-up and Sploitus card only.
Technical Details
| Aspect | Detail |
|---|---|
| CVE | CVE-2026-54121 |
| Component | AD CS Enterprise CA — directory chase during enrollment |
| Root cause | CA follows requester-supplied cdc without proving the host is a legitimate DC; uses returned objectSid / dNSHostName in issued identity |
| Prerequisites | Domain user + enrollable machine template; default ms-DS-MachineAccountQuota often sufficient to create a computer account for Netlogon-validated rogue services |
| Outcome | Certificate mapped to DC identity → certificate authentication / domain compromise in tested labs |
| Fix | July 2026 Microsoft security updates |
High-level chase abuse (conceptual):
- Create or reuse a domain computer account.
- Host rogue LDAP + SMB/LSA listeners.
- Submit a cert request embedding
cdc→ attacker IP andrmd→ target DC DNS name. - CA authenticates to rogue services as the computer account, receives forged DC directory attributes.
- CA issues cert with DC identity material; attacker uses PKINIT against the KDC.
CVE
| Field | Value |
|---|---|
| CVE | CVE-2026-54121 |
| Vendor | Microsoft — MSRC CVE-2026-54121 |
| CVSS (Sploitus card) | 8.8 |
| Patch | July 2026 Patch Tuesday train |
| Public analysis | Gist — Certighost |
Impact
Full domain compromise potential wherever Enterprise CA + vulnerable chase path + enrollable machine templates remain unpatched. Continues the AD CS abuse lineage (ESC series / Certipy ecosystem) with a new chase-target trust failure.
Mitigation
- Apply July 2026 Windows Server / AD CS-related updates on CAs and DCs.
- Audit AD CS for unusual chase traffic: CA initiating SMB:445 / LDAP:389 to non-DC hosts.
- Restrict who can enroll machine templates; lower
ms-DS-MachineAccountQuotawhere operationally feasible. - Monitor for sudden computer-account creation + certificate issuance spikes for DC-like SANs/SIDs.
- Treat public Certighost tooling as red-team/lab only; block unauthorized internal use.
Sources
- Sploitus — CVE-2026-54121 Certighost
- H0j3n / aniqfakhrul — Certighost analysis
- MSRC — CVE-2026-54121
- Certipy (related AD CS tooling ecosystem)