Certighost (CVE-2026-54121) is a critical Active Directory Certificate Services flaw that lets a low-privileged domain user trick an Enterprise CA into issuing a Domain Controller authentication certificate, potentially leading to full domain compromise. Microsoft released a fix on July 14, 2026, and defenders should patch, reduce MachineAccountQuota, restrict CA outbound connections, and monitor for abnormal enrollment and DCSync activity. #Certighost #CVE-2026-54121 #ActiveDirectory #ActiveDirectoryCertificateServices #Microsoft
Keypoints
- Certighost allows a standard domain user to obtain a certificate for a Domain Controller.
- The flaw abuses AD CS chase functionality and unverified cdc routing.
- A forged certificate can be used with PKINIT to get a Domain Controller TGT.
- DCSync can then expose krbtgt and enable full domain takeover.
- Microsoft patched the issue on July 14, 2026, and defenders should also reduce MachineAccountQuota and restrict CA communications.