A newly published exploit named Certighost demonstrates how a regular Active Directory account can become the starting point for domain-wide compromise. The attack targets CVE-2026-54121, an improper authorization vulnerability in Active Directory Certificate Services that Microsoft corrected in its July 14 security updates.
The vulnerability has a CVSS score of 8.8 and does not require administrator access or user interaction. An attacker does need network access, a valid domain account and a vulnerable enterprise certification authority configuration. Those requirements limit opportunistic internet attacks, but they are realistic once a criminal has obtained an employee credential or established an internal foothold.
How the attack crosses the trust boundary
The weakness involves an enrollment fallback process known as a chase. When a certification authority cannot obtain information about an entity, a certificate request can identify an Active Directory server and machine object that should be consulted.
Researchers found that the certification authority could follow a requester-supplied destination over SMB and LDAP without adequately verifying that it was communicating with a legitimate domain controller. A malicious user could operate rogue services, relay authentication to a real domain controller and return identity information that persuaded the authority to issue a certificate for that controller.
The resulting certificate can be used with Kerberos to authenticate as the domain controller. Because domain controllers possess directory replication rights, the attacker may then use DCSync techniques to retrieve account secrets, including material associated with the krbtgt account. Compromise of that account can undermine the trust model of the entire domain.
What administrators should do
- Install Microsoft's July 14 updates on every Active Directory Certificate Services host.
- Identify enterprise certification authorities and confirm their patch status separately from domain controllers.
- Review certificate enrollment logs for unusual machine requests and unexpected domain controller identities.
- Restrict unnecessary SMB and LDAP connectivity to certification authorities.
- Evaluate whether the default machine account quota is required for normal operations.
- Test Microsoft's chase-related mitigation in a laboratory before using it in production.
No confirmed exploitation in the wild had been reported when the technical details were published, but working proof-of-concept code is now available. That materially changes the risk because attackers no longer need to develop the chain independently.
Certificates remain a privileged attack surface
In my view, Certighost is another reminder that Active Directory security cannot stop at privileged groups and domain controllers. Enterprise certification authorities can create identities trusted across the environment, making them comparable to other Tier 0 infrastructure.
Organizations should include certificate services in privileged access workstations, network segmentation, monitoring and recovery plans. If an enterprise does not know where its certification authorities are or who can reach them, this vulnerability provides a compelling reason to find out immediately.