Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
Researchers discovered a vulnerability, dubbed ‘Certighost,’ allowing low-privilege Active Directory users to impersonate Domain Controllers by obtaining certificates. The flaw leverages a chase mechanism within Active Directory Certificate Services (AD CS), enabling attackers to steal Kerberos secrets and gain full domain access. Microsoft patched the issue on July 14, but a public exploit is now available, requiring immediate action for organizations running vulnerable AD CS configurations.
Researchers H0j3n and Aniq Fakhrul identified a vulnerability, ‘Certighost,’ that allows low-privilege Active Directory users to impersonate Domain Controllers. The issue stems from a chase mechanism within Active Directory Certificate Services (AD CS), where a CA can obtain a certificate for a Domain Controller even without direct administrative access. The researchers published a working exploit on July 24.
Microsoft patched the Active Directory Certificate Services (AD CS) issue ten days earlier as CVE-2026-54121. The vulnerability requires network access and a domain account, but no administrator rights or user interaction. The exploit leverages a chase fallback, where a CA can provide cdc and rmd attributes to a Domain Controller over SMB and LDAP without first verifying it’s a real Domain Controller.
An attacker can use a rogue Local Security Authority (LSA) and LDAP services to relay the CA’s authentication challenge to the real Domain Controller over Netlogon, obtaining the target Domain Controller's objectSid and dNSHostName. A controlled machine account supplies the valid domain identity needed for the CA to continue, and then the CA authenticates that account, signing the target Domain Controller's identity into a certificate. The public exploit automates the entire chain, creating a computer account or reusing one specified with --computer-name, and starting listeners on ports 445 and 389 to relay the CA’s challenge.
Microsoft’s July 14 update addresses the vulnerability by adding CRequestInstance::_ValidateChaseTargetIsDC to certpdef.dll, validating the target’s DNS name and userAccountControl.
Administrators who cannot patch immediately can disable the chase flag and restart Certificate Services using `certutil -setreg policy EditFlags -EDITF_ENABLECHASECLIENTDC`. The researchers recommend staging this mitigation first and treating the July update as the permanent fix. The NVD lists Windows Server 2012 through Windows Server 2025, including listed Server Core editions, as affected, along with Windows 10 versions 1607 and 1809.