Author: Len Noe, BeyondTrust Solutions Architect

Cert Ghost CVE-2026-54121: Why Active Directory Certificate Authorities Are a Critical Identity Security Risk

Every mature Active Directory environment contains a system with more power than many organizations realize: the certification authority (CA). A CA effectively defines what the entire environment is willing to trust.

When a certificate authority signs a certificate, downstream machines, services, and authentication systems generally accept that signature as proof of identity. This concentrates significant authority in a single system—one that many organizations deploy as a utility and rarely review afterward.

Cert Ghost, tracked as CVE-2026-54121, demonstrates the consequences of failing to validate that trust. Researchers published a working proof of concept on July 24, 2026, showing how a low-privileged Active Directory user with only a standard domain account could manipulate an enterprise CA into issuing a valid authentication certificate for a domain controller—and then use that certificate to impersonate the domain controller.

Microsoft released a security update on July 14, 2026, and rated the vulnerability 8.8 on the CVSS scale.

What does the Cert Ghost vulnerability do?

Active Directory Certificate Services (AD CS) is Microsoft’s public key infrastructure (PKI) for issuing and managing certificates. These certificates support smart card logon, user and device authentication, VPN access, and other identity-related services.

Under normal circumstances, a standard domain user should not be able to obtain a certificate that represents a domain controller. Cert Ghost breaks that security boundary without requiring the attacker to modify an access control list (ACL).

The vulnerability affects AD CS registration behavior associated with the “track” feature. When an enterprise CA cannot immediately resolve a target object locally, it can search for that object elsewhere using routing information supplied by the requester through a parameter known as the CDC.

The security issue is that the CA does not adequately verify whether the endpoint specified in the CDC parameter is a legitimate domain controller before communicating with it. If an attacker directs the CA to a system they control, the CA can establish an outbound connection to that rogue endpoint and accept falsified identity information, such as the target domain controller’s security identifier or DNS hostname.

The CA then trusts the supplied information, associates it with a signed X.509 certificate, and gives the attacker a certificate that identifies them as a domain controller.

From there, the attack follows a well-known Active Directory escalation path. The attacker uses the certificate’s public key extension for Kerberos, known as PKINIT, to request a ticket-granting ticket for the domain controller’s machine account.

Because a domain controller account has powerful directory replication privileges, the attacker can use DCSync-style operations against the actual domain controller to retrieve sensitive credentials, including the hash for the krbtgt account. Control of the krbtgt account can enable forged Kerberos tickets and effectively place the entire domain at risk.

Testing showed that a standard domain user account was enough to begin the attack chain. Default Active Directory settings supplied much of the required access, including the default MachineAccountQuota, which allows regular users to create machine accounts.

At the time of publication, no active exploitation had been observed. However, that should not provide reassurance. A publicly available proof of concept significantly reduces the work required to reproduce an attack. The time between a published proof of concept and its integration into commodity attack tools can be measured in weeks rather than years.

Cert Ghost is an identity security and trust validation failure

It may be tempting to classify Cert Ghost as a highly specialized PKI issue, assign remediation to the CA administrator, and move on after applying Microsoft’s patch.

However, removing the certificate-specific details reveals the broader attack pattern: an unprivileged identity manipulated a trusted system into authenticating a privileged identity, and the environment had no effective mechanism to challenge the result. At its core, this is a trust validation failure.

Certification authorities are not passive appliances. A CA is itself a privileged identity that establishes trust on behalf of the entire domain. Microsoft’s security update introduces an additional validation step to ensure that the target of a tracking search is genuinely a domain controller.

This is a recurring pattern in identity-based attacks. Adversaries rarely need to break encryption or defeat authentication directly. Instead, they look for points where a system accepts identity information without verifying its source.

Cert Ghost also highlights a less obvious problem: default Active Directory settings can grant small but persistent privileges to all authenticated users. One example is MachineAccountQuota, which is enabled by default.

Cert Ghost is one of many attack chains that can benefit from this standing privilege. Although the CVE is new, the underlying configuration and permissions it relies on may have existed in Active Directory environments for years.

The vulnerability created a shortcut, but the underlying security terrain was already risky.

An attacker who gains a low-privilege foothold may find a path toward full domain compromise when privileges accumulate in overlooked areas, including:

• Overly permissive certificate template permissions
• Unrestricted machine account creation
• Flat trust relationships between certificate authorities and domains
• Insufficient monitoring of certificate enrollment activity
• Security tools focused on endpoints rather than the identity control plane

Cert Ghost shows how these conditions can amplify the impact of a vulnerability. Patching the CVE removes one technique, but the broader identity exposure may remain and become useful in a future attack chain.

How to protect Active Directory Certificate Services from Cert Ghost

Apply Microsoft’s security update first. Microsoft’s July 14, 2026 update applies to issuing certificate authorities and adds destination validation intended to prevent the vulnerable tracking behavior.

If deployment must be delayed, researchers have documented a workaround that disables the vulnerable tracking functionality. Test this change carefully before deploying it broadly. The feature supports standard registration workflows, and disabling it may disrupt certificate enrollment processes.

Review MachineAccountQuota. Setting the domain’s MachineAccountQuota to zero removes the default ability for regular users to create machine accounts and can reduce exposure to related attack techniques.

This change may affect legitimate provisioning workflows and traditional domain-join tools. Identify those dependencies first, then route machine creation through a controlled and delegated account rather than leaving the permission available to all users.

Restrict CA network access. Limit outbound SMB and LDAP communication from your certification authorities to known and authorized domain controllers. Network segmentation and egress controls can prevent rogue endpoints from participating in the attack chain.

Audit AD CS certificate templates and enrollment permissions. Review which users, groups, and systems can request certificates, which certificate templates are enabled, and whether the certificate’s subject can represent a privileged identity. Ask whether every principal with enrollment access genuinely needs that capability.

Many organizations have never fully audited certificate enrollment permissions against their security requirements. That creates opportunities for an AD CS attack path to emerge.

Monitor identity control-plane activity. Look for unexpected machine account creation, unusual certificate enrollment, suspicious authentication certificates, and DCSync activity. Pay particular attention to certificate authority enrollment events instead of assuming endpoint telemetry will detect identity-focused attacks.

DCSync activity originating from systems that are not domain controllers should receive immediate investigation. If your detection and response tools cannot identify this behavior, closing that visibility gap should be a priority.

The real lesson from Cert Ghost

Cert Ghost may be patched, cataloged, and largely forgotten within a few months. That is the trap. If remediation ends with a knowledge base number, the organization gains little lasting protection because the specific vulnerability was never the entire problem.

The more important lesson is that trust in an enterprise is not established once and inherited forever. It must be deliberately designed, minimized, and continuously verified.

A defensible security posture is not simply a long list of patches. It is a mindset that treats identity as infrastructure and privilege as something to minimize—not a convenience to preserve indefinitely. That means reducing standing privileges wherever they exist, including in default configurations that your organization may never have intentionally selected.

Identity security requires validation at every stage, not only when an identity first enters the environment. Your certificate authority has distributed trusted identities on your organization’s behalf since it was deployed. The goal is to ensure that it issues those identities only when their authenticity can be verified.

Learn how BeyondTrust’s free Identity Security Risk Assessment can help uncover hidden identities and privilege exposures across your environment.

About the author

Len Noe is a solutions architect for BeyondTrust, a transhumanist, podcaster, international cybersecurity speaker, author, technical evangelist, and biohacker with 13 microchips.

A former black hat with more than 30 years of experience in the technology industry, he has presented in over 70 countries and was featured in the documentary “I Am Machine,” which premiered at DEF CON 2025.

BeyondTrust is a global leader in privilege-centric identity security, protecting Paths to Privilege™. Identity alone does not create risk—privilege does. As human, machine, and AI agent identities expand across every environment, BeyondTrust helps organizations discover, control, and protect them from a single platform. Trusted by more than 20,000 customers, including 75 Fortune 100 companies, BeyondTrust is recognized by leading industry analysts and is reimagining identity security as a strategic advantage.

Learn more at www.beyondtrust.com.

Sponsored and written by BeyondTrust.