AD CS Issues Domain Controller Identity Certificate to Non-DC Requester (CertiGhost/CVE-2026-54121)

Ethan Andrews@eandrews

•updated Jul 24, 2026•71•0•139

Detects anomalous certificate issuance via Active Directory Certificate Services (AD CS) where a machine-template certificate is issued to a non-computer requester, but the issued certificate's Subject Alternative Name contains a dNSHostName identifier associated with a Domain Controller. This pattern matches the exploitation of the 'CertiGhost' vulnerability (CVE-2026-54121), which allows unauthorized entities to obtain certificates masquerading as Domain Controllers for potential Kerberos authentication abuse.