A proof-of-concept exploit for the Certighost vulnerability, tracked as CVE-2026-54121, has been released, allowing authenticated attackers to potentially compromise a Windows domain.
Certighost Vulnerability
The vulnerability was fixed by Microsoft as part of the July 2026 Patch Tuesday security updates. According to Microsoft, an authenticated attacker could manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via PKINIT.
If the attacker can target a domain controller account, Microsoft says they could authenticate as the domain controller and perform privileged Active Directory operations. Security researchers H0j3n and Aniq Fakhrul reported the vulnerability to Microsoft on May 14, 2026, with Microsoft fixing the flaw in the July security updates.
Technical Details
Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration. The researchers released an exploit that can be used to gain domain-level administrative capabilities.
Abusing the AD CS chase mechanism, Active Directory Certificate Services (AD CS) is Microsoft's public key infrastructure for Windows domains and is used to issue certificates for authentication and secure communications. During certificate-based authentication, the domain controller verifies which Active Directory account the certificate belongs to and then issues Kerberos credentials.
Certighost Attack Flow
Certighost affects a fallback mechanism used by AD CS during certificate enrollment requests, which the researchers refer to as a chase, that uses two certificate request values: cdc, or Client DC, identifies the server the Certification Authority should contact. rmd, or Remote Domain, identifies the account the CA should search for.
When both attributes are supplied, the CA connects to the server specified in the cdc value and searches for the specified rmd. However, systems previously did not verify that the server supplied through the attacker-controlled cdc value was a legitimate domain controller. This allowed an attacker to run rogue SMB, LSA, and LDAP services, direct the CA to the attacker-controlled system, and return false directory information for a targeted machine account.
Released Exploit
The released certighost.py proof-of-concept automates this process by using the certificate to authenticate through PKINIT as the targeted domain controller, saving the resulting Kerberos credentials to a .ccache file and extracting the account’s NT hash. The researchers then demonstrated using the saved Kerberos credentials with Impacket's secretsdump tool to perform a DCSync attack and retrieve the krbtgt account's credentials.
Mitigation
Microsoft fixed the vulnerability as part of the July Patch Tuesday updates by adding validation to this chase process. The CA now verifies that the server specified in the cdc attribute maps to a legitimate domain controller in Active Directory and confirms that the returned identity matches the expected account.
For admins who cannot install the July security updates, the researchers say that you can disable the optional chase fallback using the following commands: certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC and Restart-Service CertSvc -Force. However, the researchers stress that this workaround is only a temporary mitigation and has not been fully tested in production environments. Therefore, admins should prioritize installing the latest security updates as soon as possible.
Source: BleepingComputer