# Certighost: How a Certificate Chase Became a Domain Takeover
When SpecterOps researchers published *Certified Pre-Owned* in 2021, they didn't just document vulnerabilities — they handed the security community a new lens through which to read Active Directory Certificate Services. Five years later, the lens is still finding things. The latest: CVE-2026-54121, a flaw in AD CS that researchers Aniq Fakhrul and Muhammad Ali are calling "Certighost," which lets a low-privileged domain user impersonate a domain controller and walk away with the keys to the entire AD environment.
Microsoft patched it in July's Patch Tuesday — a release that set an all-time record at 622 updates — but a working proof-of-concept is now public. That changes the risk calculus considerably.
## The Vulnerable Trust: What a "Chase" Actually Does
To understand Certighost, you need to know about the enrollment chase. When a client requests a certificate from an enterprise Certificate Authority in certain cross-domain controller scenarios, the CA sometimes can't immediately resolve the requester's AD identity. So it performs a fallback lookup — a "chase" — querying another domain controller to get the identity data it needs before issuing the cert.
The problem: the CA accepted the chase target without authenticating it.
Fakhrul and Ali found that by manipulating two request attributes — cdc (Client DC) and rmd (Remote Domain) — an attacker could redirect that chase lookup to a host they controlled. The CA would then reach out, ask for identity data about a domain controller, and receive whatever the attacker's machine chose to return. LDAP and LSA services running on the attacker's host. Fabricated directory data for any target principal they wanted. Certificate issued.
The CA's logic, in other words, trusted the answer before verifying the source.
## From Enrollment to Domain Compromise
This class of bug — where a privileged service performs an unauthenticated lookup during a multi-step operation — has deep roots in Windows security research. The pathway Certighost exploits is conceptually adjacent to what made ESC8 (HTTP-based NTLM relay against AD CS) so damaging: the CA isn't just a certificate printer, it's a deeply trusted identity arbiter. Convince the CA that you're someone else, and the certificate it issues carries that lie forward into every system that trusts AD.
From low-privileged domain user to domain controller impersonation is, in practical terms, from nothing to everything. A domain controller certificate opens Kerberos authentication, enables DCSync attacks for credential extraction, and in most corporate environments faces no meaningful additional controls once you've cleared that threshold.
The PoC is on GitHub. Organizations running AD CS without the July patches applied are fully exposed to any attacker with a foothold in the domain — including ransomware operators who routinely pivot through AD before detonating.
## Patch Reality and Detection Gaps
Microsoft's fix addresses the defective trust boundary — the CA must now validate that the chase target is actually the domain controller it claims to be before using the returned identity data. The patch is rated high-severity, and rightly so.
What complicates remediation is the sheer volume of July's Patch Tuesday. Six hundred and twenty-two updates creates genuine prioritization fatigue for enterprise teams. When every patch day sets a new record, the signal-to-noise ratio on critical patches drops. AD CS-related fixes deserve dedicated tracking separate from the general monthly rollup.
Detection is harder. The chase mechanism is legitimate behavior; malicious use of it doesn't produce obvious artifacts. Defenders should look for:
cdc/rmd attribute values — legitimate enrollments rarely populate these in ways that point outside the domainOrganizations with tiered AD architectures and tight CA server network segmentation will have meaningfully more detection surface than flat environments where the CA server talks freely to anything in the domain.
## HackWire Analysis
Certighost isn't a surprise — it's part of a pattern that's been visible since 2021. AD CS was effectively a research backwater until SpecterOps reframed it as an attack surface. Since then, the ESC vulnerability classes (ESC1 through ESC15 and counting), noPac, Certifried, and now Certighost have all followed roughly the same arc: researchers dig into trust assumptions baked into certificate operations, find that Microsoft's implementations trusted something they shouldn't, and document complete domain compromise as the outcome.
The "chase" fallback mechanism is exactly the kind of thing that creates these vulnerabilities — it's an edge case designed to handle cross-domain enrollment scenarios that works correctly in the expected flow but opens a gap the moment an attacker controls inputs at the boundary. The cdc and rmd attributes were almost certainly never stress-tested against adversarial input during the original feature design.
What's notable here is that the PoC release is fast. The patch dropped, the write-up followed, and now any attacker who reads security research has a working blueprint. The standard enterprise patching cycle — 30 days for critical patches, 90 for high — doesn't survive this. AD CS servers need to be treated like domain controllers: emergency-patching tier, not standard cycle.
The broader issue other coverage is underplaying: most organizations don't have meaningful network controls around their CA servers. They're domain-joined machines that talk to everything. Even with this patched, the AD CS attack surface remains vast, under-monitored, and over-trusted. Any organization that hasn't run a PKI health review against the published ESC attack classes is probably sitting on other exposure they haven't found yet.
— HackWire Editorial
## Related Coverage