Affected Systems

Microsoft Active Directory Certificate Services (AD CS) on Windows Server 2012 through 2025 (including Server Core) and Windows 10 versions 1607 and 1809. Environments with Enterprise CA and default Machine certificate template are vulnerable. CVE-2026-54121, CVSS 8.8.

Exploitation Status

Public proof-of-concept exploit released July 24, 2026 by researchers H0j3n and Aniq Fakhrul. No confirmed exploitation in the wild as of publication date, but full working exploit is publicly available.

Business Impact

Low-privileged domain users can obtain Domain Controller certificates and authenticate as DC machine accounts. Attackers can then perform DCSync to extract krbtgt hash and all domain credentials, leading to full Active Directory compromise. Exploitation requires only network access and standard domain user account (no admin rights). Attack leverages AD CS enrollment chase fallback that fails to validate requester-supplied Domain Controller references, allowing SMB/LDAP relay attacks.

Urgency

đź”´ Immediate

Recommended Actions

  • Apply Microsoft July 14, 2026 security updates to all Active Directory Certificate Services hosts immediately
  • Verify patch deployment by checking certpdef.dll contains CRequestInstance::_ValidateChaseTargetIsDC validation function
  • If immediate patching is not possible, disable chase fallback with: certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC and restart CertSvc (test in lab first as this may break legitimate enrollment)
  • Review Domain Controller authentication logs and certificate enrollment events for anomalous Machine template requests from standard user accounts
  • Audit ms-DS-MachineAccountQuota settings and reduce from default value of 10 if business requirements allow, monitor computer account creation by non-privileged users

---

# Threat Actor Context

Actor Profile

H0j3n and Aniq Fakhrul are security researchers who published a proof-of-concept exploit for CVE-2026-54121 (Certighost) on July 24, 2026. They responsibly disclosed the vulnerability to Microsoft on May 14, 2026, allowing the vendor to confirm it on May 22 and release a patch on July 14 before public disclosure. Their work focuses on Active Directory security research, specifically targeting weaknesses in Active Directory Certificate Services (AD CS) enrollment processes. The researchers developed an automated exploitation tool that demonstrates how low-privileged domain users can impersonate Domain Controllers through certificate enrollment abuse.

TTPs (Tactics, Techniques, Procedures)

T1649 (Steal or Forge Authentication Certificates): Exploits AD CS enrollment fallback mechanism to obtain fraudulent Domain Controller certificates by manipulating cdc and rmd attributes during certificate requests. T1134 (Access Token Manipulation): Leverages PKINIT to authenticate as the target Domain Controller using the forged certificate. T1557 (Adversary-in-the-Middle): Runs rogue LSA and LDAP services on ports 445 and 389, relaying CA authentication challenges to legitimate Domain Controllers over Netlogon. T1136.002 (Create Account: Domain Account): Creates computer accounts under default ms-DS-MachineAccountQuota (value of 10) or reuses controlled machine accounts to satisfy enrollment requirements. T1003.006 (OS Credential Dumping: DCSync): Uses the impersonated Domain Controller credential to perform DCSync attacks and retrieve krbtgt secrets through directory replication rights.

Targets & Patterns

The Certighost vulnerability targets organizations running Enterprise Certificate Authorities in Active Directory environments, with specific focus on the Information Technology sector managing Windows Server infrastructure. Affected systems include Windows Server 2012 through Windows Server 2025 (including Server Core editions), Windows 10 versions 1607 and 1809, and any environment using the default Machine certificate template with AD CS. Organizations are particularly vulnerable if they maintain the default ms-DS-MachineAccountQuota value of 10, allow network reachability from the CA to attacker-controlled SMB and LDAP listeners, and have not applied Microsoft's July 14, 2026 security updates. The attack requires only a low-privileged domain user account with network access—no administrator rights or user interaction—making it attractive for initial privilege escalation in enterprise environments. The ability to retrieve krbtgt secrets positions this as a high-value target for attackers seeking domain-wide persistence.

Historical Context

Certighost represents the latest in a series of Active Directory Certificate Services vulnerabilities that enable privilege escalation through certificate enrollment abuse. The researchers' naming convention and attack methodology echo previous AD CS research, particularly the Certified Pre-Owned research that documented multiple certificate-based attack primitives. The vulnerability was responsibly disclosed following a standard timeline: reported May 14, 2026, confirmed by Microsoft May 22, patched July 14 (CVE-2026-54121, CVSS 8.8), and publicly disclosed with proof-of-concept code on July 24. As of the disclosure date, no exploitation in the wild had been reported by primary sources, and the vulnerability was not listed in CISA's Known Exploited Vulnerabilities catalog. However, the publication of a working, automated exploit significantly lowers the barrier to exploitation for threat actors targeting Active Directory environments.

Defensive Recommendations

  • Apply Microsoft's July 14, 2026 security updates (CVE-2026-54121) to all AD CS hosts running Enterprise CAs immediately; the patch adds CRequestInstance::_ValidateChaseTargetIsDC validation to certpdef.dll
  • Monitor for anomalous certificate enrollment requests containing cdc and rmd attributes, particularly from computer accounts created near the default ms-DS-MachineAccountQuota limit
  • Detect T1003.006 DCSync activity by monitoring for Event ID 4662 (Directory Service Access) with properties {1131f6aa-9c07-11d1-f79f-00c04fc2dcd2} or {1131f6ad-9c07-11d1-f79f-00c04fc2dcd2} from non-Domain Controller accounts
  • Implement network segmentation to restrict SMB (445) and LDAP (389) connectivity to Certificate Authorities from untrusted endpoints; monitor for rogue LDAP/LSA services
  • As a temporary mitigation if patching is not immediately possible, disable the chase fallback using 'certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC' and restart Certificate Services, but test thoroughly in staging as this may break legitimate enrollment flows