Critical AD CS Vulnerability (CVE-2026-54121) Exposed by New PoC Exploit

Post Views: 14

Security researchers who identified and disclosed CVE-2026-54121 (referred to as Certighost), a severe privilege escalation vulnerability in Active Directory Certificate Services (AD CS), have published a proof-of-concept exploit along with detailed technical analysis of the flaw.

CVE-2026-54121 Overview

AD CS is a Microsoft Windows Server component that enables organizations to establish and manage their own Public Key Infrastructure (PKI). It functions as a Certificate Authority (CA), issuing and maintaining digital certificates used for authentication, encryption, and secure communication across networked systems. CVE-2026-54121 is classified as a critical authorization flaw with a CVSS score of 8.8. The vulnerability allows an authenticated attacker to manipulate attributes linked to a machine account and obtain a certificate from AD CS that enables authentication as the targeted machine via Public Key Cryptography for Initial Authentication in Kerberos (PKINIT). If a Domain Controller account is compromised, the attacker could authenticate as the DC and execute privileged Active Directory operations. The flaw was reported to Microsoft in May 2026 by researchers Aniq Fakhrul and Muhammad Ali. The company addressed the issue in updates released on July 14, 2026. At the time, Microsoft assessed the vulnerability as less likely to be exploited, though this evaluation may change following the public release of the PoC.

Exploit Mechanism

Exploit mechanism To exploit CVE-2026-54121, an attacker requires network access and a valid domain account. The exploit leverages a specific fallback behavior within the AD CS Certification Authority (CA) during certificate enrollment. When processing an enrollment request, the CA resolves the requester’s identity by querying a directory object. In cross-domain-controller scenarios, the CA may perform a secondary directory lookup (referred to as a “chase”) by contacting another host. This chase can be manipulated by the attacker using two attributes in the certificate request: cdc (Client DC), which specifies the host the CA should contact, and rmd (Remote Domain), which identifies the principal the CA should query. When both attributes are present, the CA establishes SMB and LDAP connections to the host designated in cdc, searches for the principal in rmd, and uses the retrieved identity data to generate a certificate. The attacker-controlled host succeeds in passing the CA’s authentication checks because a machine account created under the default ms-DS-MachineAccountQuota setting is itself a valid domain principal. This allows the rogue endpoint to satisfy the CA’s requirements, even though it is not the actual Domain Controller being impersonated. The attacker ultimately obtains a CA-signed certificate that authenticates as the target Domain Controller, which can be used via PKINIT to acquire Kerberos credentials for the DC account. Domain Controller accounts possess directory replication rights, enabling the attacker to perform a DCSync operation and extract the krbtgt account secret—the master key underpinning Kerberos in the domain. This transforms a standard domain-user account into a fully compromised domain.

Mitigation and Patching

Microsoft’s July 2026 updates for Windows 10 and various Windows Server versions address the vulnerability by validating the chase target before proceeding with the lookup. Administrators are advised to apply these updates to affected AD CS hosts immediately. If the patch cannot be implemented promptly, the vulnerable code path can be disabled using a policy flag, as the cdc chase is an optional fallback feature. This can be achieved by modifying the registry with the command `certutil -setreg policy\\EditFlags -EDITF_ENABLECHASECLIENTDC` followed by restarting the CA service via `Restart-Service CertSvc -Force`.