Certighost Vulnerability (CVE-2026-54121) Allows Low-Privilege Users to Impersonate Domain Controllers

Certighost Vulnerability Discovered

Researchers have published a working proof-of-concept for Certighost, tracked as CVE-2026-54121. This vulnerability demonstrates that a standard Active Directory user with low privileges can force an Enterprise Certificate Authority (CA) to issue an authentication certificate for a Domain Controller. This certificate can then be used to impersonate the Domain Controller.

Technical Details of the Flaw

The Certighost vulnerability resides within an Active Directory Certificate Services (AD CS) enrollment behavior known as 'chase' functionality. This feature allows an Enterprise CA to follow requester-supplied routing information (a parameter called cdc) to resolve target objects when they are not immediately available locally. The critical defect is that the CA does not verify the legitimacy of the endpoint named in cdc before connecting to it.

Attack Vector and Impact

An attacker can point the cdc parameter to a machine they control. The CA then connects to this rogue endpoint, which provides forged identity data, including the target Domain Controller’s object security identifier and DNS host name. The CA trusts this information, binds the identity to a signed X.509 certificate, and issues it to the attacker. With this certificate, the attacker can use PKINIT, the public key extension to Kerberos, to obtain a Ticket Granting Ticket as the Domain Controller's machine account, effectively becoming the Domain Controller.

Microsoft's Response

Microsoft released a fix for CVE-2026-54121 on July 14, 2026. The vulnerability was rated 8.8 on the CVSS scale, indicating a high severity. Organizations using Active Directory Certificate Services are advised to apply the update to mitigate the risk posed by Certighost.