Affected Systems

Microsoft Active Directory Certificate Services (AD CS) on Windows Server 2012 through 2025 (including Server Core) and Windows 10 versions 1607 and 1809. Environments with Enterprise CA and default Machine certificate template are vulnerable. CVE-2026-54121, CVSS 8.8.

Exploitation Status

Public proof-of-concept exploit released July 24, 2026 by researchers H0j3n and Aniq Fakhrul. No confirmed exploitation in the wild as of publication date, but full working exploit is publicly available.

Business Impact

Low-privileged domain users can obtain Domain Controller certificates and authenticate as DC machines. Attackers can then perform DCSync to retrieve krbtgt secret and achieve full domain compromise. Exploitation requires only network access and a standard domain account (no admin rights). Default configurations with ms-DS-MachineAccountQuota of 10 allow attackers to create necessary computer accounts. The vulnerability exploits AD CS enrollment chase fallback mechanism where CA follows attacker-supplied directory server references without validation, enabling relay attacks that result in CA signing certificates for DC identity.

Urgency

🔴 Immediate

Recommended Actions

  • Apply Microsoft July 14, 2026 security updates to all Active Directory Certificate Services hosts immediately to patch CVE-2026-54121
  • Verify all Enterprise CA servers running Windows Server 2012-2025 and Windows 10 1607/1809 have received updates
  • If immediate patching is not possible, disable chase fallback using: certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC and restart Certificate Services with Restart-Service CertSvc -Force (test in lab first as this may break legitimate enrollment)
  • Monitor for anomalous certificate enrollment requests from Machine template, especially those targeting Domain Controller identities
  • Review DCSync activity logs and Domain Controller authentication events for unauthorized replication requests from non-DC accounts

---

# Threat Actor Context

Actor Profile

H0j3n and Aniq Fakhrul are security researchers who discovered and publicly disclosed the Certighost vulnerability (CVE-2026-54121) affecting Active Directory Certificate Services (AD CS). They responsibly disclosed the flaw to Microsoft on May 14, 2026, and published a working proof-of-concept exploit on July 24, 2026, ten days after Microsoft patched the vulnerability on July 14. Their motivation appears to be advancing security research and raising awareness of AD CS attack surfaces. The researchers conducted binary analysis of Microsoft's patch and documented both exploitation techniques and temporary mitigations for organizations unable to immediately deploy patches.

TTPs (Tactics, Techniques, Procedures)

The Certighost exploitation chain leverages multiple MITRE ATT&CK techniques: Initial Access via Valid Accounts [T1078.002 - Domain Accounts] using a low-privileged domain user; Credential Access through OS Credential Dumping: DCSync [T1003.006] to retrieve the krbtgt secret; Privilege Escalation via Exploitation of Remote Services [T1210] by abusing the AD CS enrollment chase fallback; Defense Evasion through Use Alternate Authentication Material [T1550.003 - Pass the Ticket] after obtaining Domain Controller Kerberos credentials via PKINIT; and Lateral Movement facilitated by man-in-the-middle relay attacks against the CA's SMB (port 445) and LDAP (port 389) authentication challenges to the real Domain Controller over Netlogon. The attack creates or reuses machine accounts under the default ms-DS-MachineAccountQuota of 10, then manipulates the cdc (Active Directory server) and rmd (machine object) parameters to trick the CA into issuing a certificate for a Domain Controller without validating the target is a legitimate DC.

Targets & Patterns

The vulnerability targets organizations running Enterprise Certificate Authorities in Active Directory environments, particularly those in the Information Technology sector managing Windows Server infrastructure. Affected systems include Windows Server versions 2012 through 2025 (including Server Core editions), Windows 10 versions 1607 and 1809, and any environment with AD CS configured with the default Machine certificate template. The attack requires network access to the CA, a standard domain user account (no administrative privileges), and the ability to reach the CA from attacker-controlled SMB and LDAP listeners. Organizations with the default ms-DS-MachineAccountQuota value of 10 are particularly vulnerable, as attackers can create machine accounts to facilitate the attack chain. The exploitation pattern targets the trust relationship between CAs and Domain Controllers, exploiting the lack of validation in the enrollment chase fallback mechanism to impersonate high-privilege Domain Controller accounts and extract domain-wide secrets including the krbtgt hash.

Historical Context

Certighost represents the latest in a series of Active Directory Certificate Services vulnerabilities that enable privilege escalation and domain compromise. The flaw follows the pattern established by previous AD CS research that exposed certificate-based attack paths in enterprise environments. The vulnerability was responsibly disclosed to Microsoft on May 14, 2026, confirmed by Microsoft on May 22, 2026, and patched as CVE-2026-54121 on July 14, 2026, with a CVSS score of 8.8. The researchers published their proof-of-concept on July 24, 2026. As of that date, no exploitation in the wild had been reported by primary sources reviewed by The Hacker News, and the vulnerability was not listed in CISA's Known Exploited Vulnerabilities catalog. However, the publication of a full working exploit increases the risk of opportunistic exploitation by threat actors. The vulnerability's discovery and disclosure timeline follows responsible disclosure practices, providing organizations a ten-day window to patch before public exploit availability.

Defensive Recommendations

  • Apply Microsoft's July 14, 2026 security updates for CVE-2026-54121 on all AD CS hosts running Enterprise CAs as the primary remediation
  • Monitor for anomalous machine account creation patterns, particularly accounts created by low-privileged users approaching the ms-DS-MachineAccountQuota limit of 10 (Event ID 4741)
  • Detect DCSync activity [T1003.006] by monitoring for Directory Service Access events (Event ID 4662) with properties {1131f6aa-9c07-11d1-f79f-00c04fc2dcd2} or {1131f6ad-9c07-11d1-f79f-00c04fc2dcd2} from non-Domain Controller accounts
  • Implement network segmentation to restrict SMB (445) and LDAP (389) connectivity to Certificate Authorities from untrusted hosts, and monitor for unexpected inbound connections to CAs
  • As a temporary mitigation if patching is not immediately possible, disable the chase fallback using 'certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC' followed by 'Restart-Service CertSvc -Force', but test thoroughly in staging as this may break legitimate enrollment flows
  • Monitor certificate enrollment logs for requests containing cdc and rmd attributes, particularly those originating from non-standard sources or referencing Domain Controller identities