CVE-2026-54121 — Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)
Researchers H0j3n and aniqfakhrul published a full technical write-up and working proof-of-concept on 2026-07-24 for a flaw they call "Certighost" (CVE-2026-54121, CVSS 8.8), an Active Directory Certificate Services vulnerability Microsoft describes as "improper authorization in Active Directory Certificate Services (AD CS) [that] allows an authorized attacker to elevate privileges over a network" and fixed in the July 2026 Patch Tuesday cycle (Microsoft MSRC, 2026-07-14). Per the researchers' disclosure, the vulnerable logic sits in the Enterprise CA's enrollment "chase" fallback: when a certificate request carries the cdc (client DC) and rmd (remote domain) attributes, the CA opened connections to the requester-supplied cdc host and trusted the identity data it returned without first proving that host was actually the Domain Controller it claimed to be (CybersecurityNews, 2026-07-24).
A low-privileged domain user — using only a machine account it can self-register under the default ms-DS-MachineAccountQuota — stands up rogue LDAP/LSA services, points the chase at itself, and receives a CA-issued certificate carrying a target Domain Controller's identity. That certificate authenticates via PKINIT as the DC, and the resulting Kerberos ticket grants directory-replication rights; the PoC demonstrates a DCSync pull of the krbtgt secret, making the flaw a single-hop path from an ordinary domain foothold to full domain compromise (CybersecurityNews, 2026-07-24). Microsoft rates it "Exploitation Less Likely" and reports no public disclosure at patch time and no in-the-wild exploitation (Microsoft MSRC, 2026-07-14); the value of the 2026-07-24 disclosure is that it ships the exploitation chain publicly, collapsing the weaponization bar for any estate that skipped or deferred the July cumulative update.
The Microsoft fix adds a CA-side validation step that rejects the chase target unless it resolves to a real computer object whose userAccountControl carries the SERVER_TRUST_ACCOUNT bit (8192), with a follow-on SID comparison (CybersecurityNews, 2026-07-24).
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
Defender actions
- Confirm the July 2026 cumulative update (2026-07-14) is applied to every Enterprise CA — a working low-priv-to-DCSync PoC for this AD CS flaw is now public; unpatched CAs are directly weaponizable.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1078.002Valid Accounts: Domain Accounts
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Persistence TA0003
T1078.002Valid Accounts: Domain Accounts
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Privilege Escalation TA0004
T1078.002Valid Accounts: Domain Accounts
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Stealth TA0005
T1078.002Valid Accounts: Domain Accounts
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Credential Access TA0006
T1003.006OS Credential Dumping: DCSync
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.
T1649Steal or Forge Authentication Certificates
Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.