A vulnerability in Microsoft’s Active Directory Certificate Services (AD CS) could allow a low-privilege domain user to impersonate a Domain Controller, security researchers have warned.
Dubbed Certighost, the flaw stems from an enrollment fallback mechanism known as a “chase,” which the Certification Authority (CA) uses during directory-object resolution.
This mechanism could be used to trick the CA into picking up an attacker-controlled identity instead of a legitimate Domain Controller.
“By supplying request attributes such as cdc, an attacker could cause the CA to ask an attacker-controlled host for identity data belonging to a Domain Controller,” researchers @h0j3n, and @aniqfakhrul, said in a GitHub post. “The CA then uses that data while issuing a certificate.”
Microsoft fixed the issue in its July 2026 security updates.
Exploiting trust within the certificate issuance process
Unlike other previously reported AD CS attack techniques that abused misconfigured certificate templates or weak enrollment permissions, Certighost targets the certificate issuance workflow itself.
The researchers explained that when certificate requests include cdc (Client DC) and rmd (Remote Domain) attributes, the CA may perform a secondary directory lookup, known as a chase, to resolve identity information.
In vulnerable deployments, the CA trusts the requester-specified cdc value without verifying if the referenced server was an authentic Domain Controller.
“That made it possible for an attacker to run LDAP and LSA services on a host they controlled, direct the CA to that host, and return directory data for a chosen target principal,” the researchers explained.
According to the researchers, values such as the controller’s objectSid and dNSHostName could then be incorporated into the issued certificate, influencing the strong SID mapping and DNS identity fields used during authentication.
Because the certificate itself appeared legitimate, the researchers noted that the attack shifted from cryptography to a directory lookup that attackers could manipulate.
Researchers demonstrate the flawed and the fixed workflows
In a proof of concept (PoC) exploit, the researchers used a standard enterprise lab environment featuring an Enterprise CA, Windows Server Active Directory, the default Machine certificate template, and a low-privilege Domain user account.
The exploit automated every stage of the attack, including machine account creation, certificate enrollment, and Domain Controller impersonation.
The researchers said they looked into Microsoft’s July 2026 patch to understand the fix.
By diffing the patched binaries against the vulnerable version, they identified an additional verification step that validates the target server before the CA responds to a chase request.
“When the validation gate is active, the CA checks that the hostname supplied in cdc resolves to a legitimate Domain Controller computer object in the real directory before it continues the chase,” the researchers confirmed. “A validation failure takes the request down an error path rather than the chase continuation.”
Although Microsoft has patched the vulnerability, organizations that depend on AD CS were asked to continuously audit certificate enrollment behavior, review exposed certificate templates, and ensure domain controllers and certificate authorities receive security updates promptly.
The researchers also provided a hotfix for organizations that cannot yet apply the fix. “If the July update cannot be installed immediately, the vulnerable code path can be switched off completely with a policy flag,” they said, adding the policy that can disable the chase fallback as it is optional.
However, they warned the hotfix was only validated in controlled lab environments and should only be applied in production after testing it on a staging CA.
Microsoft did not immediately respond to CSO’s request for a comment.
No Responses