As reported by Dark Reading, Microsoft has patched a high-severity vulnerability dubbed 'Certighost' affecting Active Directory Certificate Services (AD CS) — a flaw that opens the door to privilege escalation and full Active Directory environment compromise. While the patch has landed, the real work for defenders begins now.

Security Impact: As reported by Dark Reading, Microsoft has patched a high-severity vulnerability dubbed 'Certighost' affecting Active Directory Certificate Services (AD CS) — a flaw that opens the door to privilege escalation and full Active Directory environment compromise.

Why AD CS Vulnerabilities Are Exceptionally Dangerous

Active Directory Certificate Services sits at the heart of enterprise identity infrastructure. It issues, manages, and validates digital certificates used for authentication across virtually every internal system — VPNs, workstations, servers, and service accounts. When an attacker gains the ability to abuse or impersonate certificate authority (CA) functions, they don't just get elevated privileges on a single machine. They gain a mechanism for persistent, near-undetectable access that can survive password resets, account lockouts, and even domain controller rebuilds.

This is precisely what makes the AD CS attack surface so attractive to sophisticated threat actors. The Certified Pre-Owned research from SpecterOps demonstrated years ago that misconfigurations and vulnerabilities in AD CS could be chained to achieve domain dominance — and adversaries have taken note. Nation-state groups and ransomware operators alike have incorporated AD CS abuse into their lateral movement and persistence playbooks.

Vulnerability Details

Vulnerability Name
Certighost
Affected Component
Microsoft Active Directory Certificate Services (AD CS)
Severity
High
Impact
Privilege escalation leading to full Active Directory environment compromise
Patch Status
Patched — included in Microsoft's most recent Patch Tuesday release
Exploitation in the Wild
Not confirmed publicly at time of reporting, but AD CS flaws are historically weaponized rapidly

Who Is Most at Risk?

Any organization running an on-premises or hybrid Active Directory environment with AD CS deployed is in scope. This is not a niche configuration — AD CS is the default PKI solution for the vast majority of enterprise Windows environments. Industries with the highest exposure include:
Vulnerability Details
Healthcare — heavy reliance on AD-integrated systems for medical devices and EHRs
Financial services — complex domain hierarchies with high-value credential stores
Government and defense — AD CS integral to smart card and PIV authentication
Manufacturing and critical infrastructure — OT/IT convergence environments often have legacy AD CS deployments with minimal monitoring

Organizations that have deployed AD CS but treat it as a "set and forget" service are at the greatest risk. CA servers are frequently under-monitored, infrequently patched, and given excessive trust within the environment.

The Persistence Problem

What separates certificate-based attacks from credential-based attacks is durability. A stolen Kerberos ticket expires. A compromised password can be rotated. But a fraudulently issued or stolen certificate can grant access long after the original intrusion is detected and remediated — unless defenders know to check certificate stores and revoke compromised certs explicitly. Many incident response teams still overlook this step.

Defenders who patch the vulnerability but fail to audit existing certificate issuance activity may already be hosting an attacker who issued themselves a persistence mechanism before the patch was applied.

Shield53 Recommendations

Immediate Actions

  • Apply the patch immediately. Prioritize CA servers and domain controllers in your patching queue. Do not wait for the next maintenance window — AD CS vulnerabilities are a tier-one priority.
  • Audit recent certificate issuance activity. Review logs on all CA servers for unusual certificate requests, especially those issued to privileged accounts or machine accounts in the days and weeks prior to patching.
  • Run an AD CS misconfiguration scan. Tools like Certify or the open-source PSPKIAudit can help identify exploitable certificate templates beyond the patched flaw itself.
  • Review CA server access controls. Confirm that only authorized administrators have enrollment agent rights and that dangerous certificate template permissions (e.g., ENROLLEE_SUPPLIES_SUBJECT) are locked down.
  • Enable Certificate Services logging and SIEM integration. CA audit logs are often not forwarded to SIEM platforms. Remediate this gap immediately.

Longer-Term Hardening

  • Implement tiered administration so CA operators are separated from domain admin roles.
  • Consider deploying Microsoft Defender for Identity or a comparable NDR/XDR solution with AD CS-specific detection rules.
  • Schedule periodic AD CS health assessments — this infrastructure is too critical to audit only reactively.
  • Review CISA guidance on AD hardening and incorporate AD CS-specific controls into your baseline.

Certighost is a timely reminder that the certificate infrastructure underpinning enterprise identity deserves the same rigorous attention as endpoints and perimeters. Patch fast, audit thoroughly, and assume that if this flaw was known to researchers, it was known to adversaries first.