Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

# Certighost: A Patched AD CS Flaw Lets Any Domain User Steal Domain Controller Identity — and the Exploit Is Already Public

## The Threat

A working exploit dropped July 24 for a vulnerability in Windows Active Directory Certificate Services that lets any authenticated domain user — no administrator rights, no special group membership — obtain a certificate impersonating a Domain Controller. Researchers H0j3n and Aniq Fakhrul, who named the attack chain Certighost, published a proof-of-concept the same day. Microsoft had patched the underlying flaw, CVE-2026-54121, ten days earlier on July 14.

The vulnerability lives in a rarely-discussed part of the AD CS enrollment protocol called a *chase*. When a Certificate Authority cannot resolve an end entity's information on its own, the Windows enrollment protocol allows the request to supply two attributes: cdc (which Active Directory server to contact) and rmd (which machine object to resolve). The CA dutifully followed the requester-supplied cdc host over SMB and LDAP — without first verifying that host was actually a Domain Controller. That one missing check is the entire attack surface.

The exploitation chain is mechanically elegant. An attacker with a standard domain account creates a computer object (the default ms-DS-MachineAccountQuota of 10 lets any user create up to ten), spins up rogue LSA and LDAP listeners, then relays the CA's authentication challenge to the real Domain Controller over Netlogon. The CA gets back a legitimate objectSid and dNSHostName — for the *target* Domain Controller, not the attacker's machine — and signs that identity into the issued certificate. From there, PKINIT authenticates the attacker as the DC, and the resulting Kerberos credential unlocks DCSync: the attacker can pull the krbtgt hash and every other account secret in the domain.

## Severity and Impact

| Field | Detail |

|---|---|

| CVE | CVE-2026-54121 |

| CVSS Score | 8.8 (High) |

| CVSS Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |

| CWE | CWE-285 — Improper Authorization |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | Low (domain account only) |

| User Interaction | None |

| Public Exploit | Yes — full PoC released July 24, 2026 |

| Exploitation in Wild | Not confirmed as of July 24, 2026 |

## Affected Products

The following Windows Server versions are affected, including all Server Core editions:

Prerequisite conditions for exploitation:

## Mitigations

Patch immediately. Microsoft's July 14 Patch Tuesday update adds a new validation function — CRequestInstance::_ValidateChaseTargetIsDC — to certpdef.dll. The fix enforces that before a CA follows any chase target, the supplied hostname must match exactly one Active Directory computer object with a DNS name match and a userAccountControl value that includes SERVER_TRUST_ACCOUNT (0x2000). IP literals, overlong names, and LDAP metacharacters are rejected outright. A subsequent SID comparison blocks object substitution attacks.

If immediate patching is not possible:

## References

---

## HackWire Analysis

Ten days. That is how long the window between Microsoft's patch and a working, public exploit stayed closed. For most enterprise environments running Active Directory Certificate Services, that gap is far narrower than their patch cycle.

What makes Certighost particularly dangerous is not the technical sophistication — the attack chain is a relay, the same class of technique that ESC8 and PetitPotam normalized years ago. What makes it dangerous is the *entry bar*. Every AD CS attack that demands administrator rights or a compromised service account is painful but manageable; the blast radius is bounded by how carefully you've locked down privileged accounts. Certighost only needs a domain account and the default machine-account quota that Microsoft ships enabled in every forest. That is the credential of a contractor, a new hire, an intern — or a phished employee who clicked the wrong link last Tuesday.

The fact that the CA followed attacker-supplied routing without verifying destination identity is a design-level failure that the AD CS protocol has carried for years. The researchers' binary diffing of Microsoft's fix reveals how narrow the original validation was: there was simply no check. This is not a subtle race condition or a complex parser bug. It is an authorization check that was never written.

Watch for two things in the coming weeks. First, ransomware groups that already use ESC-series attacks will likely integrate Certighost into their post-initial-access playbooks; the jump from domain user to krbtgt in a single automated chain is exactly the kind of primitive that commoditizes domain takeover. Second, organizations that patched AD CS on July 14 but not their CA-adjacent infrastructure — CAs running on older OS versions, CA servers behind delayed WSUS schedules — remain exposed even if their DCs are current.

Patch the CA hosts. That is where the vulnerable binary lives.

— HackWire Editorial

## Related Coverage