A recently disclosed vulnerability in Microsoft’s Active Directory Certificate Services has exposed a hidden privilege that can be exploited to gain control over an entire domain. The flaw, tracked as CVE-2026-54121, is known as Certighost and it allows an attacker to coerce a Certification Authority (CA) into issuing a valid authentication certificate for a Domain Controller.
This certificate can then be used to become the Domain Controller itself, effectively giving the attacker control over the entire domain. The vulnerability was first demonstrated by researchers on July 24, 2026, and Microsoft has since released a patch to address it. However, the true extent of the problem lies not in the technical details of the exploit, but rather in the fact that it highlights a deeper issue with trust and privilege within organizations.
At its core, Certighost is an example of how unprivileged identities can manipulate trusted systems into vouching for privileged identities. In this case, a standard domain user was able to obtain a certificate representing a Domain Controller by exploiting a flaw in the “chase” functionality used by the Enterprise CA. This functionality allows the CA to follow routing information provided by the requester to look up the target object elsewhere. However, it does not verify that the endpoint named in this routing information is legitimate, making it vulnerable to attack.
The attacker simply needs to point the CA at a machine under their control, which answers with forged identity data. The CA then trusts what it is told and binds that identity to a signed X.509 certificate, effectively handing the attacker a certificate that says they are a Domain Controller. From there, the attack follows a well-understood path, using the certificate to obtain a Ticket Granting Ticket as the Domain Controller’s machine account.
Once an attacker has control over the domain, they can use it to pull credential material from real DCs and forge Kerberos tickets at will. The fact that a standard Domain User account was sufficient in testing is particularly concerning, as it means that default Active Directory settings are providing everything needed for the attack.
While there is no confirmed exploitation of this vulnerability in the wild, the existence of a public proof-of-concept makes it only a matter of time before commodity tooling includes it. This highlights the need for organizations to take a closer look at their identity and privilege exposures, rather than simply patching the technical issue.
In reality, Certighost is not just a certificate bug, but a privilege and trust failure that sits at the core of identity security. It is tempting to assign responsibility for this vulnerability to whoever owns the CA, but ultimately it requires a more fundamental shift in how organizations approach identity and privilege management. By understanding and addressing these hidden exposures, organizations can reduce their risk of domain compromise and protect themselves against attacks like Certighost.
As a result, we recommend that organizations take immediate action to assess their own identity security risks. This includes reviewing default settings, access controls, and certificate issuance processes to identify potential weaknesses. By taking proactive steps to address these issues, organizations can prevent future attacks like Certighost from succeeding.
Source: Bleeping Computer — 2026-08-17