CertiGhost (CVE-2026-54121) — AD CS DC Impersonation

Researchers published a lab-tested exploit on July 24 for an AD CS flaw they call CertiGhost. In their configuration, a low-privileged domain user with CA enrollment access, a machine account, and network reachability could obtain a certificate identifying as a Domain Controller and proceed to DCSync. That’s a serious route from a normal account to domain compromise—not proof every internal CA is exploitable under any configuration.

What CVE-2026-54121 Actually Is

#

Microsoft’s published CVE record describes CVE-2026-54121 as an improper-authorization flaw in Active Directory Certificate Services (AD CS), with a CVSS 3.1 base score of 8.8 (High). It lives in how an Enterprise Certification Authority resolves identity during certificate enrollment. Under specific cross-domain-controller scenarios, the CA performs a fallback lookup — researchers call it a “chase” — where it reaches out to a second host to confirm who’s really asking for a certificate. The bug is that the CA trusted the requester to name that second host itself, with no check that the host was an actual Domain Controller.

That’s the whole vulnerability in one sentence: the CA asked a stranger who it was talking to, and believed the answer.

How the Attack Chain Works

#

The certificate request format includes two attributes an attacker can set directly: cdc (the “client DC” host the CA should contact) and rmd (the machine object the CA should look up). A vulnerable CA opens SMB and LDAP connections to whatever host is named in cdc, and treats whatever identity data comes back as authoritative.

The researchers’ proof of concept used a low-privileged domain account, a default Machine template and machine-account quota, and reachability to the CA:

1. Create (or reuse) a computer account — trivial under the default ms-DS-MachineAccountQuota value of 10, which lets any domain user register up to ten machine accounts.
2. Stand up rogue SMB/LSA and LDAP listeners on a host they control, and point the CA at it via the cdc attribute.
3. Relay the CA’s authentication challenge to a real Domain Controller over Netlogon, then hand the CA the target DC’s objectSid and dNSHostName as though the attacker’s box were authoritative.
4. Receive a signed certificate carrying the real Domain Controller’s identity.
5. Use that certificate via PKINIT to authenticate as the DC, then run DCSync to pull the krbtgt account secret and every other domain credential.

Step five is the part worth sitting with. Once an attacker has krbtgt, they can forge Kerberos tickets until the relevant secrets are properly rotated — the same Golden Ticket endgame that made Zerologon’s Netlogon impersonation trick so dangerous back in 2020. CertiGhost gets there through certificates instead of a cryptographic protocol flaw, but the destination — full, durable domain compromise from a standard user account — is identical.

Timeline: Quiet Disclosure, Loud Release

#

According to the researchers’ disclosure timeline:

• May 14, 2026 — Researchers H0j3n and Aniq Fakhrul report the flaw to Microsoft.
• May 22, 2026 — Microsoft confirms it.
• July 14, 2026 — Microsoft ships the fix as CVE-2026-54121 in that month’s security updates, with no advance public detail.
• July 24, 2026 — The researchers publish full technical details and a working exploit tool on GitHub under the name “Certighost.”

Ten days elapsed between the patch and the public disclosure. As with the SharePoint machine-key theft flaw, public exploit details shrink the time available to patch. A working lab proof of concept does not itself establish exploitation in the wild; do not wait for a KEV listing before checking exposed CAs.

Who’s Actually Exposed

#

Microsoft lists affected builds of Windows Server 2012 through Server 2025, including listed Server Core editions, and Windows 10 versions 1607 and 1809. The Windows 10 entries in the OS list do not mean those workstations host Enterprise CAs. The demonstrated attack depended on its CA configuration, an enrollable Machine template, a low-privileged domain principal and network access; confirm your deployment rather than assuming all AD CS installations share that path.

What to Do Right Now

#

1. Apply the applicable Microsoft update to affected AD CS/CA hosts and verify installed builds against the Microsoft-assigned CVE record and security advisory.
2. If immediate patching is impossible, evaluate the researchers’ lab-tested mitigation to disable the chase fallback:

   certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
   Restart-Service CertSvc -Force

   The researchers explicitly call this a mitigation, not a patch, and say they validated it only in a controlled lab. Test a staging CA with your enrollment workflows before any production change; re-enabling the flag on an unpatched CA restores the risk.
3. Review ms-DS-MachineAccountQuota and Machine-template enrollment permissions; lowering a default quota of 10 can reduce one demonstrated attack prerequisite but does not replace the update.
4. Hunt your CA logs for certificate issuances tied to Domain Controller identities requested from new or rarely-used computer accounts, especially through the Machine template.
5. Check DC replication logs for Event ID 4662 (directory replication rights) tied to unexpected source accounts — the DCSync tell — and look for Golden Ticket indicators given the roughly two-month gap between Microsoft’s confirmation and the patch.
6. Alert on anomalous CA network activity: unexpected outbound SMB (445) or LDAP (389) connections from a CA server to a non-Domain-Controller host is exactly what an in-progress chase-abuse attempt looks like.

The Bigger Pattern

#

CertiGhost is another entry in a genre that keeps expanding: bugs where a system trusts a claimed identity instead of verifying it cryptographically against something it can’t fake. The NSA-discovered Windows CryptoAPI spoofing bug from 2020 broke certificate trust at the signature-validation layer; CertiGhost breaks it at the issuance layer instead, but the failure mode — a security boundary that takes an attacker’s word for who they are — rhymes uncomfortably well. And the ten-day patch-to-PoC window here reinforces the point made in why Patch Tuesday still matters: the gap between “fixed” and “safe” is measured in days now, not months, and your patching cadence has to close that gap faster than researchers close theirs.

My Take

#

What makes CertiGhost worth writing about isn’t just its 8.8 CVSS score — it’s how little the researchers needed in their tested configuration. No admin rights or phishing email, but still an enrollable template, a machine account and reachability to the CA. That’s the same story AD CS has told for years now, from ESC1 template misconfigurations to Certifried-style impersonation: certificate services are a soft, under-audited layer sitting quietly next to the identity infrastructure everyone actually watches. If your security monitoring covers failed logons and suspicious PowerShell but has no eyes on your CA’s enrollment logs, CertiGhost is your reminder that the blind spot has a name and a public exploit now.