A proof-of-concept exploit for “Certighost,” a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain.
Tracked as CVE-2026-54121, the vulnerability was fixed by Microsoft as part of the July 2026 Patch Tuesday security updates.
“An authenticated attacker could manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via PKINIT,” Microsoft explained.
If the attacker can target a domain controller account, Microsoft says they could authenticate as the domain controller and perform privileged Active Directory operations.
Security researchers H0j3n and Aniq Fakhrul reported the vulnerability to Microsoft on May 14, 2026, with Microsoft fixing the flaw in the July security updates.
Last week, the researchers publicly disclosed the technical details regarding the vulnerability, including the release of an exploit that can be used to gain domain-level administrative capabilities.
“Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration,” reads the researchers’ technical writeup.
Abusing the AD CS chase mechanism
Active Directory Certificate Services (AD CS) is Microsoft’s public key infrastructure for Windows domains and is used to issue certificates for authentication and secure communications.
During certificate-based authentication, the domain controller verifies which Active Directory account the certificate belongs to and then issues Kerberos credentials.
Certighost affects a fallback mechanism used by AD CS during certificate enrollment requests, which the researchers refer to as a “chase,” that uses two certificate request values:
-
cdc, or Client DC, identifies the server the Certification Authority should contact. -
rmd, or Remote Domain, identifies the account the CA should search for.
When both attributes are supplied, the CA connects to the server specified in the cdc value and searches for the specified rmd.
However, systems previously did not verify that the server supplied through the attacker-controlled cdc value was a legitimate domain controller.
This allowed an attacker to run rogue SMB, LSA, and LDAP services, direct the CA to the attacker-controlled system, and return false directory information for a targeted machine account.
Source: H0j3n and Aniq Fakhrul
In the attack demonstrated by the researchers, a low-privileged user first creates a machine account, which is permitted under the default ms-DS-MachineAccountQuota configuration.
“A machine account created through the default ms-DS-MachineAccountQuota setting is a valid domain principal,” reads the report.
“This allowed the attacker-controlled chase endpoint to satisfy the authentication checks needed for the CA to continue, even though it was not the Domain Controller being impersonated.”
The attacker then submits a certificate request that directs the CA to the rogue services and targets a domain controller account. Because the CA trusts the identity information returned by the attacker-controlled services, it issues a certificate that can be used to authenticate as that domain controller and perform Active Directory operations.
The released certighost.py proof-of-concept automates this process by using the certificate to authenticate through PKINIT as the targeted domain controller, saving the resulting Kerberos credentials to a .ccache file and extracting the account’s NT hash.
The researchers then demonstrated using the saved Kerberos credentials with Impacket’s secretsdump tool to perform a DCSync attack and retrieve the krbtgt account’s credentials.
“A Domain Controller account has directory replication rights. With the resulting Kerberos credential, the attacker can request account secrets, including the krbtgt secret,” explained the researchers.
Source: H0j3n and Aniq Fakhrul
Microsoft fixed the vulnerability as part of the July Patch Tuesday updates by adding validation to this chase process.
The CA now verifies that the server specified in the cdc attribute maps to a legitimate domain controller in Active Directory and confirms that the returned identity matches the expected account.
For admins who cannot install the July security updates, the researchers say that you can disable the optional chase fallback using the following commands:
certutil -setreg policyEditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force
However, the researchers stress that this workaround is only a temporary mitigation and has not been fully tested in production environments. Therefore, admins should prioritize installing the latest security updates as soon as possible.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
