In a nutshell: Certighost exploits a fallback mechanism in certificate issuance to trick the certification authority into accepting identity data from an attacker-controlled host instead of a legitimate domain controller.
A vulnerability in Microsoft’s Active Directory Certificate Services (AD CS) allows a user with restricted permissions to impersonate a domain controller. Microsoft patched the security flaw in July 2026.
The flaw, known as Certighost, is based on a fallback mechanism called “Chase” (pursuit), which the certification authority (CA) uses when resolving directory objects. In this process, an attacker can trick the CA into processing identity data from a server under their control instead of from a legitimate domain controller. Security researchers h0j3n and aniqfakhrul demonstrated that by specifying request attributes such as cdc (Client DC), the CA can query an attacker-controlled host for identity data of a domain controller, which is then used in certificate issuance.
Unlike previous AD CS attacks that targeted misconfigured certificate templates or weak enrollment permissions, Certighost directly attacks the certificate issuance process itself. When certificate requests contain the cdc and rmd (Remote Domain) attributes, the CA can perform a secondary directory query. In vulnerable systems, the CA does not verify whether the referenced server is actually a domain controller. An attacker can therefore run LDAP and LSA services on a machine, route the CA to that machine, and return directory data for any target principal. This data—such as the objectSid and dNSHostName of the controller—is then embedded in the issued certificate and influences the strong SID mapping and DNS identity fields during authentication.
In a proof-of-concept, the researchers used a standard enterprise environment with an enterprise CA, Windows Server Active Directory, the default machine certificate template, and a user with restricted permissions. The exploit automated all phases—from creating a machine account through certificate request to domain controller impersonation.
After analyzing the July 2026 patch, the researchers identified an additional verification step: the CA now verifies that the hostname specified in the cdc attribute corresponds to an actual domain controller computer object in the directory before continuing the Chase. A validation error results in error handling instead of continuing the Chase.
Organizations using AD CS are advised to continuously review certificate enrollment, audit exposed certificate templates, and ensure that domain controllers and certificate authorities are updated promptly. In the event that the July update cannot be installed immediately, the researchers offer a hotfix: the optional Chase fallback can be disabled via a policy flag. However, this hotfix was only validated in controlled lab environments and should only be deployed in production environments after testing on a staging CA.
Source: www.csoonline.com · Published 27 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.