Certighost and the Privilege Hiding in Your Certificate Authority

Certighost, tracked as CVE-2026-54121, is a critical vulnerability in Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to coerce an Enterprise Certification Authority (CA) into issuing a valid authentication certificate for a Domain Controller. This is achieved by exploiting a 'chase' functionality flaw where the CA follows attacker-supplied routing information without validating the target endpoint, enabling the attacker to forge identity data and obtain a certificate impersonating a Domain Controller. The attacker can then use PKINIT to obtain a Ticket Granting Ticket, perform DCSync to extract credentials including the krbtgt hash, and achieve full domain compromise. The vulnerability was patched by Microsoft on July 14, 2026, but the underlying risk stems from standing privileges like default MachineAccountQuota settings that allow unprivileged users to create machine accounts.

AI-extracted · verify before operational use