A Critical Flaw in Active Directory Exposes Organizations to Domain Compromise
A disturbing vulnerability has been discovered in Microsoft’s Active Directory Certificate Services, which can be exploited by an attacker with minimal privileges to compromise an entire domain. The flaw, tracked as CVE-2026-54121, is a result of a combination of trust and privilege failure, rather than simply a certificate bug.
The exploit, known as Certighost, takes advantage of the “chase” functionality in Active Directory Certificate Services, which allows the Enterprise CA to follow requester-supplied routing information (cdc) to look up an object elsewhere. The defect lies in the fact that the CA never verifies that the endpoint named in cdc is a legitimate Domain Controller before making an outbound connection to it. An attacker can point cdc at a machine under their control, which answers with forged identity data, including the target Domain Controller’s object security identifier and DNS host name.
The CA then trusts what it is told, binds that identity to a signed X.509 certificate, and hands the attacker a certificate that says they are a Domain Controller. From there, the attack follows a well-understood path: the attacker uses the certificate with PKINIT, the public key extension to Kerberos, to obtain a Ticket Granting Ticket as the Domain Controller’s machine account. This inherently gives them directory replication rights, allowing them to run a DCSync operation against a real DC and pull credential material, up to and including the krbtgt account hash.
The exploit requires only a standard domain user account, which is sufficient because default Active Directory settings allow ordinary users to create machine accounts. While there has been no confirmed exploitation in the wild as of public disclosure, this is not a reason to be complacent. A functional, public proof-of-concept makes it clear that reproducing this exploit requires minimal effort.
The true significance of Certighost lies not in its technical complexity but in what it reveals about privilege and trust failure. It demonstrates how an organization’s reliance on trusted relationships and overlooked defaults can become a path to domain compromise. In essence, the vulnerability is not just about certificates; it’s about the hidden privilege that allows an unprivileged identity to manipulate a trusted system into vouching for a privileged identity.
To mitigate this risk, organizations should focus on implementing robust trust-validation mechanisms rather than simply patching the CA software. BeyondTrust offers a complimentary Identity Security Risk Assessment tool to help uncover hidden identity and privilege exposures across your environment before they become the next path attackers exploit.
In conclusion, Certighost is not just another certificate bug; it’s a wake-up call for organizations to reassess their trust-validation mechanisms and ensure that their security posture does not rely on outdated defaults. The hidden privilege buried in trusted relationships can no longer be ignored – it must be uncovered and addressed before it becomes the next path attackers exploit.
Source: Bleeping Computer — 2026-08-17