Certighost CVE-2026-54121: AD CS to DCSync Explained

What is the mechanism behind Certighost?

According to the analysis published by The Hacker News, the flaw sits in an AD CS enrollment fallback called "chase". The certification authority followed a requester-supplied cdc host over SMB and LDAP without verifying it was a real domain controller. An attacker impersonated that controller, relayed the authority's challenge to the real controller over Netlogon, and obtained a certificate identifying the target machine.

That certificate allows PKINIT authentication as the domain controller. Domain controller accounts hold directory replication rights, so DCSync becomes possible and the krbtgt secret can be retrieved. Whoever holds it can forge Kerberos tickets for any user, domain administrators included. The domain compromise starts from a plain user account.

What are the conditions and which versions are affected?

The reported prerequisites are a low-privileged domain account able to create a machine account (the ms-DS-MachineAccountQuota value is 10 by default) or reuse one it controls, an enterprise certification authority that takes the vulnerable path, enrollment through the default Machine template, and network reachability from the authority to the attacker's listeners. No administrator rights or user interaction are needed.

The NVD record, cited by The Hacker News, lists Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 versions 1607 and 1809. The public exploit was tested on a Windows Server 2016 or later forest with an enterprise authority. Timeline: reported to Microsoft on May 14, confirmed on May 22, patched on July 14, publicly disclosed with an exploit on July 24.

How do you detect an attempt?

1. Enable certification authority auditing and watch security events 4886 (request received) and 4887 (certificate issued), looking for certificates issued for domain controller names from user accounts or recently created machine accounts.
2. Look for machine accounts created by standard users shortly before a certificate issuance.
3. Monitor outbound connections from the authority to hosts that are not domain controllers, over SMB, LDAP or Netlogon.
4. Spot DCSync: directory replication requests coming from a machine that is not a controller.
5. Use Microsoft Defender alerts named "Potential Certighost (CVE-2026-54121) AD CS abuse" if you hold the license.

How do you fix it?

1. Install the July 14, 2026 updates on every AD CS host. Microsoft's fix validates the chase target before the authority contacts it.
2. If patching must wait, the researchers say you can clear the EDITF_ENABLECHASECLIENTDC flag and restart Certificate Services. They validated it only in a lab and it can break legitimate enrollment, so test it first.
3. Set `ms-DS-MachineAccountQuota` to 0 if your users do not need to join machines.
4. Limit certificate templates open to enrollment by authenticated users.
5. Review your overall AD CS posture, because this class of flaw recurs. See also our article on cloud security and IAM mistakes for the same excessive-privilege logic.

What changes when an AI agent is wired to enterprise identity?

In an Active Directory company, an AI agent rarely runs with an isolated identity. It uses a service account or delegated identity to read mailboxes, file shares, tickets or directories. The scenarios below are test hypotheses about AD CS and an agent with directory access, not facts reported about this CVE.

A compromised domain makes every agent identity forgeable. With krbtgt, an attacker can produce tickets for the agent's service account and act with its rights without touching the agent itself. Logs on the agent's side will look normal.

The agent's service account is often oversized. To make the agent convenient, it gets broad read rights, sometimes write rights. In a fallen domain, those rights become exploitable immediately. Least privilege is the first control to test.

Agent secrets live in the context. API tokens, connector keys and database credentials reachable by the agent are readable by whoever controls the host or the account. Our AI agent security page describes how to compartmentalize them.

Automatic actions have no guardrail. An agent that creates accounts, changes permissions or sends documents without human validation is a persistence lever for the attacker. Accounts created or rights changed without a check amount to excessive agency (LLM06, OWASP Top 10 for LLM Applications 2025): the agent becomes a persistence lever.

The attacker can also target the agent through content. Once inside the domain, dropping a booby-trapped document in a share the agent reads amounts to indirect prompt injection (see prompt injection), with the added trust given to internal files.

Controls to put in place: agent service accounts with minimal scope and no domain privileges, short-lived tokens, segmentation between the agent and controllers, human validation of identity-management actions, separate logging.

How do you test this surface on an enterprise agent?

We start from the agent's account: real rights, groups, reachable secrets, actions possible without approval, and what injected content can make it do. We also test identity takeover: what a ticket or token stolen outside its normal context allows. Each point is documented with reproducible evidence.

For an agent that touches the directory and its certificates, our Agent Red Team Express checks in 5 days (1,900 €) how far an identity obtained this way can go, after a free 30-minute discovery call.