Certighost: Critical AD CS Directory Chase Vulnerability

Certighost (CVE-2026-54121) is a critical vulnerability in Active Directory Certificate Services (AD CS) discovered by researchers H0j3n and Aniq Fakhrul. The flaw exists in the 'chase' enrollment fallback mechanism, where a Certification Authority (CA) follows requester-supplied directory routing attributes (cdc and rmd) without verifying the authenticity of the target host. This allows an attacker to direct the CA to a rogue LDAP/LSA service, which returns forged identity data for a Domain Controller (DC). Microsoft patched the issue in July 2026.

Technically, the attack chain leverages an attacker-controlled machine account (often created via default ms-DS-MachineAccountQuota) to satisfy authentication requirements when the CA connects to the rogue host. The CA then issues a valid X.509 certificate carrying the identity of a target DC. Using this certificate via PKINIT, attackers can obtain Kerberos credentials for the DC account, enabling directory replication (DCSync) to extract the krbtgt hash and achieve full domain compromise.

This vulnerability represents a significant risk to organizations using Enterprise CAs, as it bypasses standard access control lists and turns the CA into a manufacturing point for illegitimate trusted identities. While no in-the-wild exploitation was confirmed at the time of disclosure, the release of a functional Python-based proof-of-concept makes immediate patching of all Tier 0 CA infrastructure mandatory.