In summary: The Certighost vulnerability in AD CS allows low-privilege attackers to impersonate a domain controller and access sensitive account secrets via DCSync.
A functional exploit for the CVE-2026-54121 vulnerability in Windows Active Directory Certificate Services demonstrates how attackers with basic user rights can compromise domain controllers and extract Krbtgt hashes. Microsoft has patched the vulnerability since Patch Tuesday in July 2026.
Security researchers H0j3n and Aniq Fakhrul reported vulnerability CVE-2026-54121 to Microsoft on 14 May 2026 and published an automated exploit script (certighost.py) and technical report in July. According to Microsoft’s description, the vulnerability allows an authenticated attacker to manipulate attributes of a machine account and obtain a certificate from AD CS that permits PKINIT-based authentication as that machine.
The attack exploits the so-called Chase fallback mechanism in certificate requests. This feature uses two parameters: cdc (Client DC) for the targeted server and rmd (Remote Domain) for the sought account. AD CS did not validate the cdc parameter to verify it corresponded to a genuine domain controller. An attacker can therefore set up falsified SMB, LSA, and LDAP services and inject false identity data. With basic user rights, the attacker creates a legitimate machine account via the default ms-DS-MachineAccountQuota setting, which acts as a valid domain principal.
The published certighost.py script automates certificate requests, performs PKINIT authentication, stores Kerberos credentials in a CCACHE file, and reads the domain controller’s NT hash. Subsequently, integration with Impacket secretsdump enables a DCSync attack to extract the Krbtgt hash. Because domain controller accounts possess directory replication rights, the attacker can use the resulting Kerberos token to request account secrets, including the Krbtgt secret.
Microsoft resolved the issue through strict validation of the cdc attribute in the July 2026 update. The certification authority now verifies whether the server is a genuine domain controller in Active Directory. For environments that have not yet deployed the update, Microsoft offers disabling the Chase fallback option as a temporary measure: certutil -setreg policyEditFlags -EDITF_ENABLECHASECLIENTDC and Restart-Service CertSvc -Force. The security researchers emphasize that this is only a transitional solution and installation of official patches should take priority.
Source: www.it-daily.net · Published 31 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.