A relatively new vulnerability in Windows Server called Certighost (CVE-2026-54121) allows a user with minimal privileges to gain control over the domain.
The flawed part is an AD CS enrollment fallback during directory-object resolution. When this mechanism is used, the Certification Authority contacts the specified domain controller (attribute cdc) to obtain information about the object associated with the request (attribute rmd).
The vulnerability is based on the fact that the CA does not verify whether the cdc actually points to a legitimate domain controller. Therefore, an attacker can specify an attacker-controlled host with fake LDAP/LSA services to respond to the request.
It’s clear that the best protection is to install the update on all ADCS servers. But how to find out if your servers have been attacked before updating? Read Dmitry Shchetinin’s article “Detecting Certighost attack”.
