Affected Systems

Microsoft Active Directory Certificate Services (AD CS) in Windows domains. CVE-2026-54121 patched in July 2026 Patch Tuesday. Affects environments using AD CS for certificate-based authentication where attackers have low-privileged domain user access.

Exploitation Status

Public proof-of-concept exploit (certighost.py) released by H0j3n and Aniq Fakhrul. Exploit automates domain controller impersonation via manipulated certificate enrollment. No reports of active exploitation in the wild at this time.

Business Impact

Authenticated attackers with low-privileged domain credentials can escalate to domain administrator by impersonating domain controllers. Attack abuses AD CS certificate enrollment chase mechanism to obtain DC certificates, enabling DCSync attacks to extract krbtgt and other privileged account credentials. Default ms-DS-MachineAccountQuota settings permit initial machine account creation required for exploitation. Organizations using AD CS for PKI authentication are at risk if July 2026 patches are not deployed.

Urgency

🔴 Immediate

Recommended Actions

  • Apply Microsoft July 2026 Patch Tuesday updates immediately to all domain controllers and Certificate Authority servers to fix CVE-2026-54121
  • If patching is delayed, disable the chase fallback mechanism using: certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC followed by Restart-Service CertSvc -Force
  • Monitor Certificate Authority logs for unusual certificate enrollment requests with cdc and rmd attributes pointing to non-DC systems
  • Review and reduce ms-DS-MachineAccountQuota to limit machine account creation by low-privileged users (default allows 10 per user)
  • Audit recent certificate issuances for domain controller accounts and investigate any issued to unexpected requestors or from unusual client sources