A critical exploit chain targeting Active Directory Certificate Services has been publicly disclosed alongside functional proof of concept code, allowing low privilege domain users to achieve complete domain takeover. The attack mechanism exploits a logic flaw within certificate enrollment chase fallbacks to trick the Certificate Authority into signing machine certificates with Domain Controller identities.
The vulnerability, tracked as CVE-2026-54121 and codenamed Certighost, affects Enterprise Certificate Authorities running across Windows Server environments. An authenticated domain user leveraging default machine account creation quotas can deploy a rogue SMB and LDAP listener. When initiating a certificate request, the attacker forces the Certificate Authority to follow an unverified chase target, relaying authentication challenges over Netlogon to return the target Domain Controller object SID. The CA signs the certificate, granting Kerberos credentials that allow the attacker to execute DCSync routines and dump krbtgt password hashes.
Subverting domain controller identity boundaries introduces catastrophic exposure across entire Active Directory forests. Because domain controller accounts hold directory replication privileges, an unprivileged attacker can forge Golden Tickets, bypass multi factor authentication gates, and secure permanent administrative persistence across local and cloud environments.
– Ensure immediate deployment of Microsoft July 14 security updates across all Active Directory Certificate Services hosts.
– Reduce or set the default ms-DS-MachineAccountQuota attribute to zero across active domain controller configurations.
– Audit Active Directory Certificate Services enrollment logs for anomalous machine certificate requests originating from non-DC accounts.
– Monitor domain controllers for unexpected DCSync RPC calls or Netlogon authentication relay attempts.
Active Directory architecture safety relies on strict identity validation during certificate enrollment to guarantee that Certificate Authorities do not sign unverified machine identity claims. #CodeDefence #ActiveDirectory #ADCS #Certighost #DCSync #Kerberos #IdentitySecurity #AppSec
/
