New Certighost PoC exploit lets attackers hijack Windows domains

Why Your AD CS Patch Isn't the End of the Certighost Story

Recent reports highlight how Certighost allows attackers to hijack Windows domains. CVE-2026-54121 has quickly garnered significant attention within the security community. A low-privileged domain user can, with a publicly available exploit, impersonate a Domain Controller and achieve full domain compromise. Microsoft pushed a patch on July 14, 2026, ten days before researchers H0j3n and Aniq Fakhrul dropped their proof-of-concept (PoC) on July 24, 2026. This immediately highlights the importance of patching your Active Directory Certificate Services (AD CS) servers.

Simply applying the patch, however, doesn't fully address the underlying issue. A deeper understanding of the mechanism is crucial for effective defense against future variants and for detection in environments where immediate patching isn't feasible. Let's delve into the mechanism behind this vulnerability.

A dimly lit server room with blinking LEDs, fog drifting through racks, cool blue ambient light with warm rim accents — Dimly lit server room with blinking LEDs, fog

The Incident: A Low-Privilege Path to Domain Admin

Certighost, tracked as CVE-2026-54121, is an improper authorization vulnerability in Windows Active Directory Certificate Services. It allows an authenticated, low-privileged Active Directory user to obtain a certificate for a Domain Controller. This certificate can then be used to authenticate as the DC itself. A standard user, without admin rights, can become a Domain Controller. This effectively leads to a full domain compromise.

The flaw was reported to Microsoft on May 14, 2026, and confirmed quickly. Their July 2026 Patch Tuesday security updates, released on July 14, included the fix. Last week, the researchers released their PoC, making this a significant threat for any unpatched environment. As of July 24, 2026, Microsoft has not observed active exploitation in the wild. However, the public PoC significantly increases the risk of it occurring soon.

The Mechanism: Abusing the "Chase" Fallback

At its core, Certighost exploits a specific AD CS enrollment fallback mechanism known as a "chase." When a Certification Authority (CA) processes a certificate request, it sometimes needs to "chase" additional information from a Domain Controller. The `cdc` (Client DC) and `rmd` (Remote Domain) values in the certificate request are critical here.

The vulnerability was straightforward: during this chase process, the CA would follow a requester-supplied cdc host for Server Message Block (SMB) and Lightweight Directory Access Protocol (LDAP) without properly validating it as a legitimate Domain Controller.

The attack chain unfolds as follows:

**Account Creation**: An attacker, as a low-privileged user, first creates a machine account in Active Directory. This is often possible by default due to the `ms-DS-MachineAccountQuota` setting, which typically allows users to create up to 10 computer accounts.
**Rogue Services**: The attacker then sets up rogue SMB, LSA, and LDAP services on a system they control.
**Malicious Request**: They submit a certificate request to the AD CS server. This request is crafted to direct the CA's "chase" process to the attacker's rogue services, specifically targeting a legitimate Domain Controller account.
**CA Misdirection**: The CA, trusting the attacker-controlled `cdc` value, connects to the attacker's rogue services. The attacker's services then relay the CA's authentication challenge to the *legitimate* Domain Controller over Netlogon.
**False Information**: The attacker's services return false directory information for the targeted Domain Controller account, including its `objectSid` and `dNSHostName`. The CA, believing it's communicating with a real DC, accepts this.
**Certificate Issuance**: The CA, now convinced it's dealing with a legitimate request for the targeted Domain Controller, issues a certificate for that DC.
**PKINIT Authentication**: The `certighost.py` PoC then uses this newly issued certificate to authenticate via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos) as the targeted Domain Controller. This allows the attacker to save Kerberos credentials to a `.ccache` file.
**DCSync and Krbtgt**: Finally, the attacker uses tools like Impacket's `secretsdump` with the obtained Kerberos credentials to perform a DCSync attack. This pulls the `krbtgt` account's credentials, which is the master key to the entire Kerberos environment.

Practically, this means any attacker with network access and a standard domain account can forge Kerberos tickets for any user or service within the compromised domain, leading to a full domain compromise.

The Impact: Domain Compromise

With a CVSS score of 8.8, its severity is clear. Unlike a denial-of-service or minor information leak, this vulnerability offers a direct path to full domain compromise. Once an attacker has the `krbtgt` hash, they can create Golden Tickets, granting them highly persistent and difficult to detect administrative access to your domain. They can impersonate any user or service for any duration.

The vulnerability affects a wide range of Windows Server versions, from 2012 through 2025, including Server Core editions. Even some Windows 10 versions (1607 and 1809) are listed as affected in the NVD record. If you're running AD CS, your environment is likely affected.

While Microsoft hasn't seen active exploitation by threat actors in the wild as of July 24, 2026, the public PoC makes this vulnerability much more accessible to a wider range of attackers, and such flaws are often rapidly integrated into attack toolkits.

A close-up of a blue team analyst's hands typing rapidly on a keyboard, multiple monitors displaying security dashboards with alerts and network traffic graphs, shallow depth of field, cool blue light — Close-up of a blue team analyst's hands typing

The Response: Patch, Validate, Detect

Microsoft's fix, delivered on July 14, 2026, adds key validation to the chase process. Specifically, they added `CRequestInstance::_ValidateChaseTargetIsDC` to `certpdef.dll`. This validation now rejects suspicious inputs like IP literals or overlong names. More importantly, it requires the CA to verify that the server specified in the `cdc` attribute maps to a legitimate Domain Controller in Active Directory, checking its DNS name and confirming its `userAccountControl` includes `SERVER_TRUST_ACCOUNT`. There's also a later SID comparison to block object substitution.

Addressing this vulnerability requires several actions, starting with patching your AD CS servers. Applying the July 14, 2026, security updates to all Active Directory Certificate Services hosts is the essential and permanent fix.

For environments where immediate patching isn't feasible, Microsoft offers a temporary workaround: disable the optional chase fallback. It's important to note that this is a temporary measure, not fully tested in production, and it carries the risk of disrupting legitimate enrollment flows. Therefore, prioritizing the full patch remains critical.

In addition to patching, strengthening your detection capabilities is crucial. Microsoft Defender should alert on "Potential Certighost (CVE-2026-54121) AD CS abuse" or "Active Directory Certificate Services attack tool activity." General monitoring should look for LDAP reconnaissance, suspicious Kerberos ticket requests, and especially DCSync activity, which are common post-exploitation indicators. Enable Certificate Services auditing for both successful and failed operations, setting your CA audit filter to capture certificate lifecycle activity. Monitor Security events 4886 (a certificate request was received) and 4887 (a certificate was issued) for unusual requests or certificates issued through machine templates that contain unexpected Domain Controller identity data. A machine account suddenly obtaining a certificate for a DC is a significant red flag.

The Certighost exploit clearly demonstrates how even minor fallback mechanisms can conceal significant vulnerabilities. While patching is a critical initial step, a comprehensive understanding of the attack chain and robust detection capabilities are essential for securing your domain.