'Certighost' Flaw in Active Directory Certificate Services Enables Domain Compromise

Microsoft recently issued a patch addressing “Certighost,” a high-severity flaw in Active Directory Certificate Services that allows threat actors to escalate privileges and potentially achieve complete domain compromise.

The Mechanics of Active Directory Certificate Flaws

Active Directory Certificate Services (AD CS) serves as the Public Key Infrastructure (PKI) backbone for enterprise environments, managing identity certificates used for network authentication, code signing, and data encryption. Because certificates are natively trusted by Kerberos and NTLM authentication protocols, security flaws within AD CS handling or certificate enrollment present an extraordinarily high-value target for attackers.

In typical certificate escalation attacks, an authenticated user with low privileges requests a certificate using misconfigured or vulnerable certificate templates. If an attacker can manipulate enrollment requests or supply a custom Subject Alternative Name (SAN), AD CS issues a valid digital certificate identifying the user as a Domain Admin or another high-privilege identity. The attacker then presents this certificate during Kerberos authentication to obtain a Ticket Granting Ticket (TGT), completely bypassing password controls and securing administrative access across the Active Directory forest.

Blast Radius and Operational Impact

Active Directory is the central authentication authority for most enterprise networks, making privilege escalation vulnerabilities in PKI components inherently severe. An adversary leveraging the Certighost flaw can systematically compromise domain controllers, forge authentication tickets for long-term persistence, access sensitive organizational data, and pivot laterally into federated cloud identity environments like Microsoft Entra ID.

Because certificate-based authentication bypasses traditional password policies and MFA challenges if misconfigured, certificate abuse often eludes basic endpoint security tools unless explicit auditing for AD CS events is configured across all issuing Enterprise Certification Authorities (CAs).

Remediation and Defensive Actions

To safeguard identity infrastructure against Certighost and related PKI abuse, security teams should execute the following steps:

• Apply Microsoft’s latest security updates across all domain controllers and Active Directory Certificate Services servers.
• Audit all active certificate templates for insecure settings, particularly permissions allowing low-privileged users to enroll in templates configured with client authentication capabilities or the ENROLLEE_SUPPLIES_SUBJECT flag.
• Enable extended auditing on enterprise CAs, monitoring Event ID 4887 (certificate request approved) and Event ID 4768 (Kerberos authentication ticket requested via certificate) to detect anomalous certificate requests and ticket requests across the domain.