chpratik/cve-2026-54121Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
| Field | Finding |
|---|---|
| CVE | CVE-2026-54121 |
| Name | Certighost |
| Vendor | Microsoft |
| Component | Active Directory Certificate Services, AD CS |
| Weakness | CWE-285 — Improper Authorization |
| Impact | Elevation of Privilege; potential Domain Controller impersonation |
| CVSS v3.1 | 8.8 High — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| MSRC max severity | Critical |
| EPSS | 0.010520 / 60.799 percentile as of 2026-07-27 |
| CISA KEV | Not Found as of 2026-07-28 |
| Public PoC | Available on GitHub |
| Confirmed in-the-wild exploitation | Not Found in reviewed public reporting |
| Primary enterprise risk | Low-privileged authenticated user may obtain certificate identity material enabling Domain Controller impersonation and DCSync risk |
Certighost is dangerous because it targets the trust foundation of a Windows domain: certificate-based identity.
A successful attack can allow a low-privileged domain user to abuse AD CS certificate enrollment behavior and potentially obtain a certificate mapped to a Domain Controller identity. If that happens, the attacker may authenticate as the Domain Controller and perform privileged Active Directory operations.
The most important downstream risk is:
Domain Controller impersonation → DCSync → krbtgt exposure → Golden Ticket-level domain compromise risk
The flaw exists in an AD CS Enterprise CA enrollment fallback known as a chase.
In vulnerable behavior:
cdc and rmd attributes.cdc target during directory-object resolution.Microsoft patched the issue in July 2026 by adding validation logic that checks whether the supplied chase target is a legitimate Domain Controller before continuing.
flowchart TD
A[Low-privileged domain account] --> B[Create or reuse machine account]
B --> C[Submit AD CS enrollment request]
C --> D[Request includes cdc and rmd attributes]
D --> E[Vulnerable CA follows requester-controlled chase target]
E --> F[CA contacts attacker-controlled SMB/LDAP host]
F --> G[Attacker supplies Domain Controller identity data]
G --> H[CA issues certificate identity material]
H --> I[PKINIT authentication as target machine]
I --> J{Target is Domain Controller?}
J -->|Yes| K[DCSync / privileged AD operations]
K --> L[krbtgt exposure / domain compromise risk]
J -->|No| M[Machine identity impersonation]| Platform | Fixed Build | Patch |
|---|---|---|
| Windows Server 2025 / Server Core | 10.0.26100.33158 | KB5099536 |
| Windows Server 2022 | 10.0.20348.5386 | KB5099540 |
| Windows Server 2019 / Server Core | 10.0.17763.9020 | KB5099538 |
| Windows Server 2016 / Server Core | 10.0.14393.9339 | KB5099535 |
| Windows Server 2012 R2 / Server Core | 6.3.9600.23291 | KB5099444 |
| Windows Server 2012 / Server Core | 6.2.9200.26226 | KB5099445 |
| Windows 10 Version 1809 | 10.0.17763.9020 | KB5099538 |
| Windows 10 Version 1607 | 10.0.14393.9339 | KB5099535 |
Operational priority: Patch AD CS / Enterprise CA servers first.
| Item | Status | Confidence |
|---|---|---|
| Public PoC | Found | High |
| GitHub repositories | Found | Medium-High |
| Exploit-DB | Not Found | Medium-High |
| Metasploit module | Not Found | Medium |
| CISA KEV | Not Found | High |
| Confirmed active exploitation | Not Found | Medium-High |
| Ransomware usage | Not Found | Medium-High |
| APT attribution | Not Found | Medium-High |
| Exploit maturity | Public PoC available | High |
timeline
title CVE-2026-54121 Certighost Timeline
2026-05-14 : Vulnerability reported to Microsoft
2026-05-22 : Case confirmed per researcher timeline
2026-06-11 : CVE reserved
2026-07-14 : Microsoft patch and advisory released
2026-07-24 : Public Certighost analysis and PoC released
2026-07-27 : EPSS record date: 0.010520
2026-07-28 : CTI report finalizedcdc and rmd attributes.krbtgt exposure risk.Disable the vulnerable chase fallback by clearing EDITF_ENABLECHASECLIENTDC only after testing. This can break legitimate enrollment workflows. The July 2026 update remains the recommended remediation.
Event ID 4886 or 4887
AND request attributes contain:
cdc
rmd
Process: certsrv.exe
Outbound port: 389 or 445
Destination: non-Domain-Controller host
Event ID 4741
Computer account created by standard user
Followed by suspicious certificate issuance
Event ID 4662
Replication GUIDs:
1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
89e95b76-444d-4c62-991a-0facbeda640c
Source is not an expected Domain Controller or identity-management system
| Environment | Risk | Priority | Recommended Action |
|---|---|---|---|
| Unpatched Enterprise CA reachable by standard domain users | Critical | P0 | Patch immediately, hunt, restrict CA egress |
| Unpatched CA with Machine template enrollment broadly available | Critical | P0 | Patch, review template ACLs, monitor issuance |
| Patched CA but exposed during public PoC window | High | P1 | Hunt historical requests and DCSync indicators |
| Offline root CA | Medium | P2 | Patch during controlled maintenance |
| No AD CS / no Enterprise CA | Low | P3 | Validate absence and monitor asset inventory |
| Category | Result |
|---|---|
| Attacker IPs | Not Found |
| Attacker domains | Not Found |
| Malicious URLs | Not Found |
| Malware hashes | Not Found |
| Registry keys | Not Found |
| Mutexes | Not Found |
| Public PoC filename | certighost.py |
| Relevant request attributes | cdc, rmd |
| Relevant process | certsrv.exe |
| Relevant component | certpdef.dll |
| Key network signal | CA outbound SMB/LDAP to non-DC host |
The complete enterprise CTI report is available here:
It includes:
Patch AD CS. Hunt certificate abuse. Restrict CA egress. Protect the domain trust chain.