Microsoft’s Active Directory Certificate Services have been left vulnerable to a high-severity flaw that could allow attackers to compromise entire AD environments. Dubbed “Certighost,” this vulnerability was recently patched by Microsoft as part of its record-breaking 622 Patch Tuesday updates.
Researchers Aniq Fakhrul and Muhammad Ali, who discovered the flaw, described how it works: an attacker can manipulate certificate enrollment fallback mechanisms known as a “chase” to trick the Certificate Authority into querying an attacker-controlled host for AD identity information. This allows the CA to accept requester-supplied chase targets without verifying their authenticity.
In simpler terms, this vulnerability exploits a trust boundary within the Active Directory Certificate Services, which treats its own directory as the source of truth about who is who. As a result, anyone who can add an entry to the directory can shape what a certificate claims, effectively allowing attackers to impersonate domain controllers and compromise AD environments.
The flaw was present in the way certificates are issued for client authentication, where a CA accepts information supplied by the requestor without verifying its authenticity. This is a common risk scenario in many protocols, including directory referrals, DNS delegation, and OAuth redirects.
Active Directory Certificate Services act as Microsoft’s public key infrastructure (PKI) implementation that integrates with Active Directory to issue X.509 certificates for purposes such as encryption, signing, secure communications, and authentication. While the private key stays with the requester, the certificate contains the public key and identity information signed by a CA.
The vulnerability affects enterprise CAs handling of AD CS enrollment fallback mechanisms, which are used in cross-domain controller enrollment scenarios. By manipulating request attributes such as cdc (Client DC) and rmd (Remote Domain), an attacker can cause the CA to query an attacker-controlled host for AD identity information, allowing them to compromise the AD environment.
This flaw is particularly concerning because it could allow attackers to escalate privileges and access sensitive data within an organization. It’s essential that administrators ensure their systems are up-to-date with the latest patches to prevent such attacks.
To mitigate this risk, organizations should prioritize regular updates and patching of Active Directory Certificate Services. Additionally, implement robust security measures, such as monitoring for suspicious activity and implementing strict certificate management policies, can help prevent exploitation of this vulnerability.
Source: Dark Reading — 2026-07-28