CVE-2026-54121, Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)

Researchers H0j3n and aniqfakhrul published a full technical write-up and working proof-of-concept on 2026-07-24 for a flaw they call "Certighost" (CVE-2026-54121, CVSS 8.8), an Active Directory Certificate Services vulnerability Microsoft describes as "improper authorization in Active Directory Certificate Services (AD CS) [that] allows an authorized attacker to elevate privileges over a network" and fixed in the July 2026 Patch Tuesday cycle (Microsoft MSRC, 2026-07-14). Per the researchers' disclosure, the vulnerable logic sits in the Enterprise CA's enrollment "chase" fallback: when a certificate request carries the cdc (client DC) and rmd (remote domain) attributes, the CA opened connections to the requester-supplied cdc host and trusted the identity data it returned without first proving that host was actually the Domain Controller it claimed to be (CybersecurityNews, 2026-07-24).

A low-privileged domain user (using only a machine account it can self-register under the default ms-DS-MachineAccountQuota) stands up rogue LDAP/LSA services, points the chase at itself, and receives a CA-issued certificate carrying a target Domain Controller's identity. That certificate authenticates via PKINIT as the DC, and the resulting Kerberos ticket grants directory-replication rights; the PoC demonstrates a DCSync pull of the krbtgt secret, making the flaw a single-hop path from an ordinary domain foothold to full domain compromise (CybersecurityNews, 2026-07-24). Microsoft rates it "Exploitation Less Likely" and reports no public disclosure at patch time and no in-the-wild exploitation (Microsoft MSRC, 2026-07-14); the value of the 2026-07-24 disclosure is that it ships the exploitation chain publicly, collapsing the weaponization bar for any estate that skipped or deferred the July cumulative update.

The Microsoft fix adds a CA-side validation step that rejects the chase target unless it resolves to a real computer object whose userAccountControl carries the SERVER_TRUST_ACCOUNT bit (8192), with a follow-on SID comparison (CybersecurityNews, 2026-07-24).