A proof-of-concept exploit for the “Certighost” vulnerability, identified as CVE-2026-54121, has emerged, raising concerns about the security of Windows domain environments. This flaw, which affects Windows Active Directory Certificate Services, allows authenticated attackers to potentially compromise a Windows domain. Microsoft addressed this vulnerability in its July 2026 Patch Tuesday security updates.
According to Microsoft, an authenticated attacker could manipulate attributes associated with a machine account to obtain a certificate from Active Directory Certificate Services (AD CS), enabling them to authenticate as that machine via PKINIT. If the attacker successfully targets a domain controller account, they could authenticate as the domain controller itself, thereby executing privileged Active Directory operations.
The vulnerability was reported to Microsoft by security researchers H0j3n and Aniq Fakhrul on May 14, 2026. Following the disclosure, Microsoft implemented a fix in the July security updates. Last week, the researchers publicly shared the technical details of the vulnerability, including the release of an exploit capable of granting domain-level administrative capabilities.
In their technical writeup, the researchers described Certighost as an AD CS vulnerability that permitted a low-privileged domain user to impersonate a Domain Controller, leading to a potential domain compromise in the tested AD CS configuration.
Abusing the AD CS chase mechanism
Active Directory Certificate Services (AD CS) serves as Microsoft’s public key infrastructure for Windows domains, facilitating the issuance of certificates for authentication and secure communications. During the certificate-based authentication process, the domain controller verifies the ownership of the certificate by checking the associated Active Directory account before issuing Kerberos credentials.
Certighost exploits a fallback mechanism utilized by AD CS during certificate enrollment requests, referred to as a “chase.” This mechanism relies on two certificate request values:
cdc(Client DC) identifies the server that the Certification Authority (CA) should contact.rmd(Remote Domain) specifies the account that the CA should search for.
When both attributes are provided, the CA connects to the server indicated by the cdc value and searches for the specified rmd. However, prior to the fix, systems did not verify whether the server specified through the attacker-controlled cdc value was a legitimate domain controller. This oversight allowed attackers to run unauthorized SMB, LSA, and LDAP services, directing the CA to their controlled system and returning false directory information for a targeted machine account.
Source: H0j3n and Aniq Fakhrul
In the attack demonstrated by the researchers, a low-privileged user first creates a machine account, a process permitted under the default ms-DS-MachineAccountQuota configuration. The researchers noted, “A machine account created through the default ms-DS-MachineAccountQuota setting is a valid domain principal.” This allowed the attacker-controlled chase endpoint to satisfy the authentication checks required for the CA to proceed, despite not being the impersonated Domain Controller.
Subsequently, the attacker submits a certificate request that directs the CA to the rogue services while targeting a domain controller account. Since the CA trusts the identity information returned by the attacker-controlled services, it issues a certificate that can be used to authenticate as that domain controller and perform Active Directory operations.
The released certighost.py proof-of-concept automates this process, enabling the attacker to authenticate through PKINIT as the targeted domain controller, store the resulting Kerberos credentials in a .ccache file, and extract the account’s NT hash. The researchers demonstrated the use of these saved Kerberos credentials with Impacket’s secretsdump tool to execute a DCSync attack, retrieving the krbtgt account’s credentials.
“A Domain Controller account has directory replication rights. With the resulting Kerberos credential, the attacker can request account secrets, including the krbtgt secret,” the researchers explained.
Source: H0j3n and Aniq Fakhrul
Microsoft addressed the vulnerability in the July Patch Tuesday updates by adding validation to the chase process. The CA now verifies that the server specified in the cdc attribute corresponds to a legitimate domain controller in Active Directory and confirms that the returned identity aligns with the expected account.
For administrators unable to install the July security updates, the researchers recommend disabling the optional chase fallback using specific commands. However, they emphasize that this workaround serves only as a temporary mitigation and has not undergone comprehensive testing in production environments. Therefore, it is crucial for administrators to prioritize the installation of the latest security updates promptly.
