Microsoft’s Active Directory Certificate Services (AD CS) have been left vulnerable to exploitation after researchers uncovered a flaw that allows attackers to impersonate domain controllers and compromise AD environments. The issue, dubbed “Certighost,” was patched in Microsoft’s recent Patch Tuesday update but not before proof-of-concept exploit code was released.
The vulnerability affects the enterprise certificate authority’s (CA) handling of an Active Directory Certificate Services enrollment fallback mechanism known as a “chase.” In this process, the CA queries a second directory for identity information when issuing certificates. Attackers can manipulate request attributes to trick the CA into querying an attacker-controlled host for AD identity data, ultimately allowing them to impersonate domain controllers.
This exploitation is possible due to a defective trust boundary within the certificate-based client authentication aspect of Microsoft Active Directory Services. As Jason Soroko, senior fellow at Sectigo, explains: “Active Directory treats its own directory as the source of truth about who is who, and the certificate service will vouch for whatever the directory says.” This means that anyone with access to add an entry to the directory can shape what a certificate claims.
The flaw was discovered by researchers Aniq Fakhrul and Muhammad Ali, who released proof-of-concept exploit code for the vulnerability. According to their findings, the CA would accept request-supplied chase targets without first verifying their authenticity, allowing attackers to run LDAP and LSA services on an attacker-controlled host and direct the CA to that host.
The exploitation of this vulnerability could have severe consequences for organizations relying on Active Directory Certificate Services. Certificates are often used for encryption, signing, secure communications, and authentication purposes. The researchers explained that certificate templates control the enrollment process, deciding who may request a certificate, what it can be used for, and whether the CA may accept information supplied in the request.
While Microsoft has patched the vulnerability, organizations must remain vigilant and ensure they have implemented the latest security patches to protect against potential exploitation. As Soroko notes: “A low-trust party hands a high-trust component a pointer, and the component follows it without asking whether the target is who the pointer claims.” This highlights the importance of verifying trust boundaries in certificate-based authentication processes.
To mitigate this risk, organizations should focus on implementing robust security measures to prevent attackers from manipulating request attributes. Regularly updating Active Directory Certificate Services with the latest patches and ensuring that all users have up-to-date certificates are also crucial steps in preventing exploitation. As the cybersecurity landscape continues to evolve, it’s essential for organizations to remain proactive in addressing vulnerabilities like Certighost and protecting their AD environments.
Source: Dark Reading — 2026-07-28