Allows a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration.

Certighost is a vulnerability in Active Directory Certificate Services (AD CS) that enabled a low-privileged domain user to impersonate a Domain Controller, resulting in full domain compromise within the tested AD CS environment. Microsoft resolved this issue in the July 2026 security updates. The vulnerability stems from an AD CS enrollment fallback mechanism—referred to as a "chase"—that occurs during directory-object resolution. By including specific request attributes, such as cdc, an attacker could trick the Certification Authority (CA) into querying an attacker-controlled host for identity information tied to a Domain Controller. The CA would then incorporate this attacker-supplied data into the certificate issuance process

The CA trusted the requester-supplied chase target without verifying that it was actually the Domain Controller it claimed to represent. This gap allowed an attacker to stand up LDAP and LSA services on a host under their control, point the CA toward that host, and supply fabricated directory data for any target principal of their choosing.

In the vulnerable flow, the attacker includes cdc and rmd parameters in a certificate request. The CA then establishes SMB and LDAP connections to the address specified in cdc, carries out the chase lookup for the principal named in rmd, and incorporates the returned identity data into the certificate-building process.

The core problem extends beyond simply making an outbound connection—the CA treated whatever data came back from that host as authoritative directory information. In the tested attack chain, the attacker was able to return a Domain Controller's objectSid and dNSHostName values. These fields fed directly into the certificate's identity material, including the strong-mapping SID and DNS identity fields relied upon during authentication.

Because the default ms-DS-MachineAccountQuota setting permits any domain user to create a machine account, and such accounts count as valid domain principals, the attacker's rogue chase endpoint was able to pass the authentication checks required for the CA to proceed—despite not being the genuine Domain Controller it was impersonating.

Read more/lab: 🔗: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26