Certighost and the Privilege Hiding in Your Certificate Authority
Every mature Active Directory environment has a component that quietly holds more power than the people running it usually admit: the Certification Authority (CA). The thing your entire estate has agreed to believe. When it signs a certificate, every machine, service, and authentication flow downstream treats that signature as truth.
Certighost, tracked as CVE-2026-54121, is a reminder of what happens when that trust is misplaced. Researchers published a working proof-of-concept on July 24, 2026, demonstrating that a low-privileged Active Directory user can coerce an Enterprise CA into issuing a valid authentication certificate for a Domain Controller, then use that certificate to become the Domain Controller.
What Certighost actually does
Active Directory Certificate Services is Microsoft's public key infrastructure, issuing and managing the certificates that underpin smart card logon, device and user authentication, and VPN access. A standard domain user has no business obtaining a certificate that represents a Domain Controller, yet Certighost breaks that boundary without touching a single access control list.
The flaw lives in an AD CS enrollment behavior known as 'chase' functionality. When an Enterprise CA cannot immediately resolve the target object locally, it can follow requester-supplied routing information to look the object up elsewhere. The defect is that the CA never verifies that the endpoint named in the routing information is a legitimate Domain Controller before it reaches out to it.
The Attack Chain
An attacker points the routing information at a machine they control and the CA dutifully makes an outbound connection to that rogue endpoint, which answers with forged identity data, including the target Domain Controller’s object security identifier and DNS host name. The CA trusts what it is told, binds that identity to a signed X.509 certificate, and hands the attacker a certificate that says they are a Domain Controller.
From there, the attack follows a well-understood path. The attacker uses the certificate with PKINIT, the public key extension to Kerberos, to obtain a Ticket Granting Ticket as the Domain Controller's machine account. Domain Controller accounts inherently hold directory replication rights, enough to run a DCSync operation against a real DC and pull credential material, up to and including the krbtgt account hash.
Reducing the Risk
Patch first. Apply Microsoft's July 14, 2026 update to every issuing Certification Authority because it introduces the destination validation that shuts down the specific chase abuse. If deployment is delayed, researchers documented a workaround that disables the vulnerable chase functionality.
Beyond the immediate fix, reduce the standing privilege the attack relied on. Setting the domain's MachineAccountQuota to zero removes the default ability for ordinary users to create machine accounts, meaningfully shrinking the attack surface for this class of technique.
Then constrain the CA itself. Restrict outbound SMB and LDAP from your Certification Authorities so they can only communicate with known, authorized Domain Controllers, which directly undercuts the rogue-endpoint step in the chain.
Review Enterprise CA deployments, certificate templates, and enrollment permissions: which principals can request this, and does that population have any business holding the identity this certificate represents?
The Real Takeaway
Certighost will be patched, cataloged, and largely forgotten within a quarter. That is the trap. If the response stops at the KB number, the organization learns nothing durable because the specific bug was never the point. The point is that trust in an enterprise is a thing you architect and continuously validate, not a property you configure once and inherit forever.
The defensible posture is not a longer patch list. It is a mindset that treats identity as infrastructure and privilege as risk to be minimized rather than convenience to be preserved. Reduce standing privilege wherever it hides, including the defaults you never chose, and validate trust at every point where a system is about to act on it, not just at the front door.
Source: BleepingComputer