Certighost CVE-2026-54121: Public Exploit Turns a Domain User Into a Domain Controller

On July 24, 2026, researchers H0j3n and Aniq Fakhrul published a full technical writeup of Certighost together with a working proof-of-concept exploit. Microsoft had already fixed the underlying flaw ten days earlier, in the July 2026 security updates.

Their summary is blunt. Certighost is an Active Directory Certificate Services vulnerability that allowed a low-privileged domain user to impersonate a domain controller and achieve domain compromise in the tested AD CS configuration.

That last qualifier matters and the researchers repeat it. The chain was demonstrated in a specific lab setup rather than proven universal. It was, however, a lab built entirely from defaults: a forest at Windows Server 2016 functional level or later, an Enterprise CA, the default machine account quota of 10, and the default Machine certificate template with its stock access control list.

Active Directory Certificate Services is Microsoft's public key infrastructure for Windows domains. It issues certificates that a client can present to the Key Distribution Center to obtain Kerberos credentials, so a certificate is effectively a signed statement about who you are.

The flaw lives in an enrollment fallback the researchers call a chase. In some cross-domain-controller enrollment scenarios, the certification authority performs a second directory lookup, and two request attributes steer it: cdc names the host the CA should contact, and rmd names the principal it should look up there.

The missing check was simple. The CA followed the host supplied in cdc without first establishing that it was actually a domain controller. An attacker could stand up their own LDAP and LSA services, point the CA at that machine, and return directory data belonging to a real domain controller. The CA then used those attacker-supplied values, including the object SID and DNS hostname, when building the certificate it issued.

One detail explains why the CA accepted the rogue endpoint at all. A machine account created under the default ms-DS-MachineAccountQuota setting is a valid domain principal, which was enough to satisfy the authentication checks the CA performed before continuing.

Holding a certificate that authenticates as a domain controller is not the end of the chain, it is the pivot. The researchers' proof-of-concept authenticates through PKINIT as the targeted domain controller, saves the resulting Kerberos credentials to a credential cache file, and extracts the account's NT hash.

What follows is standard post-exploitation. A domain controller account holds directory replication rights, so those credentials permit a DCSync operation, which requests account secrets from the directory. The researchers demonstrated retrieving the krbtgt account credentials, the key material behind every Kerberos ticket in the domain.

At that point the domain is not compromised in a recoverable sense, it is owned. Recovering from krbtgt exposure means a double rotation of that account and a forced re-issuance of every ticket in the environment, which is disruptive enough that most organisations plan it as an incident rather than a maintenance task.

The exposure is narrower than the impact suggests, but not by much. Several conditions had to hold together in the demonstrated chain:

• An Enterprise certification authority present in the forest
• A forest functional level of Windows Server 2016 or later
• Any authenticated domain account, with no administrative rights required
• The default ms-DS-MachineAccountQuota of 10, letting that account create a machine account
• The default Machine certificate template with its stock access control list

None of those is exotic. AD CS is widely deployed, often installed years ago for one specific purpose and left running since. The machine account quota default has been criticised for years precisely because it hands ordinary users a domain principal on request, and it remains at 10 in a large number of estates.

The researchers are careful to scope their claim to the configuration they tested rather than asserting universality. That caution is appropriate and should not be read as reassurance: the tested configuration was assembled from Microsoft defaults, not from an unusual setup.

The July update adds validation to the CA-side request path. Before continuing a chase, the CA now checks that the hostname supplied in cdc resolves to a genuine domain controller computer object in the directory, rejecting IP literals and malformed values along the way, and it compares the resolved object's SID against the requester's. A failed check sends the request down an error path instead of continuing.

There is a caveat that mainstream coverage has not carried, and it comes from the researchers' own binary analysis. The new validation sits behind a servicing feature gate. The patched build retains a legacy branch that is reached when that gate is not enabled, and the researchers state plainly that the protection applies when the gate and its validation path are active, noting that the feature state mattered for their own lab validation.

The practical reading is not that the patch is ineffective. It is that installing the update and confirming the protection is in force are two different actions, and only the first is visible from a patch management console.

Patch the certificate authority servers with the July 2026 security updates. That is the fix, and with a public exploit in circulation it should not wait for the next maintenance window.

For estates that genuinely cannot patch immediately, BleepingComputer reports the researchers offering an interim step: disabling the optional chase fallback on the CA. The same reporting carries their caveat, which deserves equal weight. It is a temporary mitigation that has not been fully tested in production environments, so treat it as a stopgap and test it before it touches anything that matters.

Beyond patching, two pieces of long-standing Active Directory hardening are worth revisiting because the demonstrated chain leaned on them. Reducing ms-DS-MachineAccountQuota to zero removes the ability for ordinary users to create machine accounts, which was the step that let the rogue endpoint pass as a valid domain principal. Tightening enrollment permissions on certificate templates limits who can submit requests to the CA in the first place. Neither is a substitute for the update, and neither should be changed without understanding what in your environment relies on the current setting.

Retrospective hunting is warranted on any CA that was unpatched between mid-July and whenever the update landed. The signals are ordinary Windows events, which is the good news, and they are individually unremarkable, which is the bad news.

4741   Computer account created            -> flag when the creator is a non-privileged user
4886   Certificate services received request
4887   Certificate services approved request -> flag when the subject is a DC account
4662   Operation on directory object        -> flag replication GUIDs from non-DC sources

Also worth alerting on:
  outbound SMB/LDAP from the CA server to hosts that are not domain controllers
  PKINIT authentication for a DC account from an unexpected source address

Correlated in a short window, that sequence is the attack. Individually, each has legitimate explanations, which is why single-event alerting on any one of them tends to be abandoned for noise.

As for what comes next, the gap between patch and public exploit was ten days, which is short. AD CS has produced a steady run of named attack techniques over the past several years, and the underlying pattern here, a service trusting routing information supplied by the party making the request, is not unique to this code path.

A single authenticated domain account was enough to obtain a certificate authenticating as a domain controller, and from there to replicate the krbtgt secret. The privilege gap crossed in one chain is the largest available in an Active Directory environment.

Security: Complete loss of Active Directory trust boundaries. Certificate-based authentication and Kerberos are both undermined, and the attacker holds key material permitting forged tickets.

Privacy: Directory replication exposes credential material for every account in the domain, with downstream consequences for any system authenticating against it.

Certighost, CVE-2026-54121, let a low-privileged Active Directory user obtain a certificate authenticating as a domain controller through an unvalidated AD CS enrollment fallback, then replicate the krbtgt secret. Microsoft patched it on July 14, 2026 and a working exploit went public on July 24.