Microsoft has patched a serious Active Directory Certificate Services (AD CS) flaw that handed any low-privileged domain user the keys to an entire Windows network. Tracked as CVE-2026-54121 and nicknamed Certighost, the bug let an ordinary account impersonate a Domain Controller—the servers that decide who's who inside a domain—and pull off a full compromise.
Researchers @h0j3n and @aniqfakhrul disclosed the vulnerability today, alongside a working proof-of-concept on GitHub. Microsoft shipped the fix in its July 14 security updates after the pair reported it in May.
The trick: pointing the CA at a fake Domain Controller
The weakness lives in an obscure enrollment fallback called a chase—a second directory lookup the Certification Authority (CA) performs during certain cross-domain requests. Two request attributes steer it: cdc, which names the host the CA should contact, and rmd, which names the principal to look up.
The CA trusted whatever host the requester supplied in cdc without checking that it was actually a Domain Controller. As the researchers put it, the CA accepted the chase target "merely because it responds as a domain principal."
An attacker could stand up rogue LDAP and LSA services on a machine they controlled, aim the CA at it, and feed back a real Domain Controller's identity data—its SID and DNS hostname. The CA then baked those values into a signed certificate. Because Windows domains ship by default, allowing users to create machine accounts (ms-DS-MachineAccountQuota = 10), the rogue endpoint could pass the CA's authentication checks.
From one account to the whole domain
The impact is severe. The team's Poc certighost.py script chains the entire attack in a single run: it discovers the CA, creates a machine account, launches the fake listeners, requests the poisoned certificate, then uses it to authenticate as the target DC. From there, DCSync replication rights let the attacker dump the krbtgt secret—the master key for forging Kerberos tickets across the domain. The tool ends its output with a cheeky "GGWP."
What to do
Apply Microsoft's July 2026 update. It forces the CA to verify that any cdc target resolves to a genuine DC computer object in Active Directory before continuing, and adds a SID comparison to block object substitution.
If patching must wait, admins can disable the optional chase feature entirely:
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC Restart-Service CertSvc -Force
The researchers caution that this is a stopgap, not a cure—re-enabling the flag on an unpatched CA reopens the door.