Microsoft Patches Certighost Flaw Enabling Domain Controller Impersonation

Microsoft has fixed a high-severity Active Directory Certificate Services (AD CS) vulnerability tracked as CVE-2026-54121, nicknamed Certighost, carrying a CVSS score of 8.8. The flaw let a low-privileged domain user obtain a valid certificate impersonating a Domain Controller by exploiting a fallback lookup process called a 'chase,' where the Certification Authority accepted attacker-supplied server and identity data without verifying it belonged to a genuine Domain Controller.

Researchers H0j3n and Aniq Fakhrul demonstrated the attack chain in a lab, escalating from a standard domain account to full domain compromise via DCSync and retrieval of the krbtgt credential. The cryptographic signing itself was not broken — the CA correctly signed the certificate — but it trusted unverified directory information beforehand. This also bypassed Microsoft's strong SID binding protection added after 2022's Certifried vulnerability, since the false SID was already embedded before signing.

Microsoft's July 2026 update adds verification steps confirming the target server is a legitimate Domain Controller and that the resolved SID matches before completing the chase. Organizations running affected Windows Server versions, from Server 2012 through Server 2025, should apply the patch immediately; disabling the chase fallback is a documented but risky interim workaround. No in-the-wild exploitation was reported before disclosure, but a working proof of concept is now public, shrinking the window for unpatched systems.