Certighost Hands Domain Keys to Any Low-Privileged Active Directory User

May 14, July 14, July 27, 2026. Three dates that tell the story of Certighost: reported to Microsoft by H0j3n and Aniq Fakhrul, patched in the July 2026 Patch Tuesday, a public exploit dropped less than two weeks later. CVE-2026-54121 is a flaw in Active Directory Certificate Services (AD CS) rated CVSS 8.8 that allows any authenticated user with zero elevated privileges to obtain a domain controller certificate — and with it, the keys to the kingdom.

If you run a Windows domain and haven’t deployed the July 2026 updates yet, stop reading and patch. If you already have, here’s how this bug works and why AD CS remains the weakest link in most Active Directory environments.

AD CS: the PKI you installed and forgot about

Active Directory Certificate Services is the PKI infrastructure built into Windows Server. It issues certificates used for authentication, encryption, and code signing. In an Active Directory domain, a certificate can replace a password for authentication through PKINIT (public key cryptography for initial authentication) — the protocol behind smart card logon and, increasingly, passwordless deployments.

The structural issue is simple: AD CS gets installed, configured once, and then ignored. SOC teams monitor domain controllers, privileged accounts, and protected group memberships — but certificate templates rarely make the audit checklist. Since 2021, when Will Schroeder and Lee Christensen published their foundational Certified Pre-Owned research on certificate-based attack paths, we’ve known that AD CS is a first-class attack surface. Certighost is the latest evidence, and it’s among the most severe.

The chase mechanism, weaponized

The core of CVE-2026-54121 lies in a fallback mechanism in the certificate enrollment service, which the researchers call the chase. When a Certification Authority (CA) can’t find the target account locally during a certificate request, it queries another server using two attacker-supplied attributes from the request:

• cdc (Client DC): the server the CA should contact;
• rmd (Remote Domain): the account to look up in that domain.

Prior to the July 2026 update, the CA performed no validation on whether the server specified by cdc was actually a legitimate domain controller. An attacker could point the CA to rogue SMB, LSA, and LDAP services under their control, and have it return fabricated directory information for the targeted machine account — including a domain controller.

The attack: from machine account to krbtgt

The full attack chain, automated by the certighost.py script released on July 27, 2026, takes four steps:

1. Create a machine account. By default, any authenticated domain user can create up to 10 machine accounts through the ms-DS-MachineAccountQuota attribute. This account, though created by a low-privileged user, is a valid domain principal.

2. Submit a crafted certificate request. The attacker submits a request with both cdc and rmd attributes set. cdc points to an attacker-controlled server; rmd targets the domain controller account.

3. Identity spoofing. The CA contacts the rogue server, which responds with the DC’s identity. Because the CA doesn’t verify the contacted server’s legitimacy, it issues a valid authentication certificate for the domain controller account.

4. Domain compromise. The attacker uses the certificate to authenticate via PKINIT as the DC, retrieves a Kerberos ticket, and runs a DCSync attack using Impacket’s secretsdump to extract domain secrets — including the krbtgt account hash, the crown jewel of Active Directory.

The bottom line: a standard domain user, with no special privileges, gains domain admin access in a handful of commands. No privilege escalation, no code execution on the DC, no memory dumping required.

CVSS 8.8 understates the real-world blast radius

The NVD entry assigns a score of 8.8 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H:

• Network-based, low attack complexity;
• Low privileges required (any domain account, no special groups needed);
• No user interaction;
• High impact on confidentiality, integrity, and availability.

A score of 8.8 is already critical, but Certighost’s real danger is its automation. The PoC reduces the attack to a script that runs in seconds. An attacker who gains a foothold in the domain through any initial vector — phishing, a compromised service account, a workstation pivot — can escalate to domain-wide compromise without exploiting any secondary vulnerability. In practice, Certighost turns any initial access into full domain takeover.

Patch and workaround

Microsoft fixed the flaw by adding validation to the chase process: the CA now verifies that the server specified by cdc maps to a legitimate domain controller in Active Directory, and confirms that the returned identity matches the expected account.

For organizations that can’t immediately deploy the July 2026 updates, the researchers offer a mitigation by disabling the optional chase fallback:

certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force

Caveat: this workaround has not been exhaustively tested in production. It disables an optional feature, but the researchers stress it is a temporary measure only. The patch remains the only reliable fix.

For those wondering about equivalents: this is the kind of vulnerability the UK’s NCSC and CISA would flag within 24 hours of a public PoC release. At the time of writing, CISA has not yet added it to the Known Exploited Vulnerabilities catalog, but the pattern — CVSS ≥ 8, public exploit, active AD infrastructure targeting — checks every box.

Certighost also highlights a broader architectural problem. Since SpecterOps published Certified Pre-Owned in June 2021, the security community has understood that AD CS misconfigurations can create direct paths to domain dominance. Yet four years later, certificate template auditing remains absent from most organizations’ standard hardening checklists. Tools like Certify and Certipy have made enumeration trivial; Certighost now adds a code-execution-free, fully automated exploitation path to that arsenal. The July 2026 patch closes this specific vector, but it does not fix the underlying reality: if your AD CS templates have not been audited in the past six months, you are almost certainly vulnerable to a certificate-based attack you have not identified yet.

Verdict

Certighost is not an exotic bug requiring obscure services or unusual topologies. It hits the default AD CS deployment in standard configurations — which is to say, most enterprise Windows domains.

If you manage an Active Directory with AD CS, two immediate actions:

1. Deploy the July 2026 patches on every AD CS server. The PoC is public, the attack is scripted, and the window between patch and weaponization was thirteen days.
2. Audit your certificate templates. Certighost is yet another warning about the certificate attack surface. If you don’t know which templates are enabled in your internal PKI, assume an attacker does.

The Patch Tuesday window keeps shrinking. When the PoC drops before the month is out, it’s no longer a maintenance decision — it’s a race.

References

• Microsoft Security Update Guide — CVE-2026-54121
• National Vulnerability Database — CVE-2026-54121
• BleepingComputer — New Certighost PoC exploit lets attackers hijack Windows domains, July 27, 2026
• Help Net Security — PoC exploit released for critical AD CS domain-takeover flaw, July 27, 2026
• H0j3n and Aniq Fakhrul — Certighost technical writeup