Certighost CVE-2026-54121: a low-priv AD user becoming a Domain Controller

> In short: CVE-2026-54121 (codenamed Certighost) is an Active Directory Certificate Services authorization flaw (CVSS 8.8) patched on July 14. A low-privileged domain user can obtain a certificate for a Domain Controller and authenticate as that machine. Because DC accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret via DCSync — full domain compromise from a normal user account. Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24.

Why this matters to you

If you sell to enterprise clients — hospitals, local government, large industrials — their Active Directory is the identity backbone your SaaS integrates with. AD CS (Active Directory Certificate Services) is the component that issues the certificates behind smartcard login, S/MIME, VPN, and increasingly the certificate-based authentication your own SSO relies on.

Certighost is the latest entry in a multi-year line of AD CS flaws (ESC1 through ESC15, then a steady drip of new variants) that turn a misconfigured CA into a domain-compromise primitive. The pattern matters because your clients' domain is one hop from your product: a compromised Domain Controller can issue credentials, forge tickets, and reach any integrated SaaS that trusts the tenant.

The flaw in two sentences

A normal Domain Users account can create a computer account (default ms-DS-MachineAccountQuota is 10) or reuse one it already controls. Through a vulnerable AD CS certificate template chain path, that user can then enroll for a certificate identifying a Domain Controller — and authenticate to the domain *as that DC*.

Because Domain Controller accounts hold directory replication privileges, the resulting Kerberos ticket grants DCSync rights. DCSync lets the attacker request the krtgt password hash from a DC. Whoever holds krbtgt can forge Kerberos tickets for any user, including Domain Admin — game over for the forest.

Microsoft classed the flaw as improper authorization, CVSS 8.8, exploitation requiring network access and a domain account but no admin rights and no user interaction.

Why AD CS keeps producing these

AD CS is powerful and defaults are permissive. The flaw class that produced Certighost — vulnerable template chain building — exists because certificate templates are composable: an attacker doesn't need one misconfigured template, they need a *path* through several that ends at a high-privilege target. Each individual template can look fine in isolation. The compromise only emerges when you trace the chain.

This is why point-in-time AD CS hardening (the classic ESC1–ESC8 fixes) is necessary but not sufficient. New chain paths appear as templates evolve. Continuous review is the only posture that catches them.

What to do

The lesson

Certighost is the nth reminder that Active Directory Certificate Services is high-value, under-audited infrastructure. For a SaaS vendor whose enterprise clients run AD, the question is no longer whether AD CS attacks exist — they clearly do, and they keep evolving. The question is whether you've documented the integration assumptions that protect your product when a client's domain falls.