AD CS Trust Check Hands Users Domain Controller Power
A normal domain user can abuse AD CS to become a Domain Controller in the directory. The broken step is the CA trusting a requester-supplied directory lookup before it has proved the target is really a DC, so a low-privilege account can end up with a machine certificate that carries replication rights.
Researchers published a working Certighost exploit for CVE-2026-54121 on July 24, after Microsoft patched the flaw on July 14. The chain works in default-style environments with an Enterprise CA and the standard machine-account quota, and it can lead to DCSync access to krbtgt and other replication secrets.
Patching the CA closes the flaw, but the real risk is the trust path inside AD CS: any system that issues privileged certificates from directory lookups can turn an ordinary domain account into a high-trust machine identity.