Key Takeaways
- A fully working public proof-of-concept, dubbed Certighost, was released on July 24, 2026 for CVE-2026-54121, a CVSS 8.8 improper-authorization flaw in Active Directory Certificate Services (AD CS) that Microsoft patched ten days earlier on July 14, 2026.
- The exploit lets any low-privileged, authenticated domain user with no requirement for admin rights or user interaction required to obtain a valid certificate impersonating a Domain Controller and use it to run DCSync and extract the krbtgt secret, a precursor to Golden Ticket-level domain compromise.
- As of July 24, 2026, CVE is not yet listed in CISA’s Known Exploited Vulnerabilities catalog. However, the absence of reporting does not rule out prior or ongoing abuse, and organizations should treat this as an active, urgent patching priority.
Incident Overview
Security researchers H0j3n and Aniq Fakhrul reported the underlying AD CS flaw to Microsoft on May 14, 2026; Microsoft confirmed it on May 22 and shipped a fix in its July 14, 2026 security updates as CVE-2026-54121. On July 24, 2026, the researchers publicly disclosed full technical details and released a working exploit tool on GitHub, naming the vulnerability “Certighost.” Dataminr’s monitoring detected the public disclosure, including the technical write-up and exploit code, in real time as it was published. The flaw affects Enterprise Certification Authority (CA) deployments across a broad range of Windows Server versions (Server 2012 through Server 2025, including Server Core editions) and Windows 10 versions 1607 and 1809, making it relevant to nearly any organization running an internal Microsoft PKI.
Dataminr Detection
Technical Details
Certighost abuses an AD CS enrollment fallback known as a “chase,” used when a CA cannot directly resolve an end entity’s identity during certificate issuance. The certificate request protocol allows a requester to supply a cdc attribute (the Active Directory server to contact) and an rmd attribute (the machine object to resolve). The vulnerable CA followed the requester-supplied cdc host over SMB and LDAP without first verifying it was a legitimate Domain Controller.
To exploit this, an attacker with only a standard domain account creates (or reuses) a computer account — trivial under the default ms-DS-MachineAccountQuota value of 10 — and stands up rogue SMB/LSA and LDAP listeners. The attacker relays the CA’s authentication challenge to the real Domain Controller over Netlogon, then returns the target DC’s objectSid and dNSHostName to the CA as though the attacker-controlled host were authoritative. The CA authenticates the attacker’s low-privileged machine account and signs a certificate carrying the target Domain Controller’s identity. The attacker then uses that certificate via PKINIT to authenticate as the DC and, from there, invokes DCSync to retrieve the krbtgt account secret and other domain credentials.
Exploitation requires only network reachability to the CA and its published services (no administrator rights or user interaction), an Enterprise CA following the vulnerable chase path, and enrollment available through the default Machine certificate template — conditions common in unmodified AD CS deployments.
Microsoft’s July 2026 fix adds a validation routine (CRequestInstance::_ValidateChaseTargetIsDC) to the CA-side request path. Before continuing a chase, the CA now confirms the supplied cdc hostname resolves to a genuine Domain Controller computer object in Active Directory, with a matching DNS name and the SERVER_TRUST_ACCOUNT flag set, plus a SID comparison to block object substitution. Requests that fail validation are rejected rather than processed.
Threat Actor & Motivation
No specific threat actor or intrusion set has been publicly attributed to exploitation of Certighost. The vulnerability was identified and disclosed through independent security research rather than observed criminal or nation-state activity, and no primary source reviewed as of July 24, 2026 has reported active exploitation. However, the low barrier to entry (a standard domain account, no admin rights, no user interaction) and the severity of the outcome (domain-wide credential compromise via DCSync) make this an attractive technique for ransomware affiliates and other actors conducting post-compromise privilege escalation and lateral movement once initial domain access is obtained.
Immediate Actions & Recommendations
- Patch all Enterprise CA servers now. Apply Microsoft’s July 14, 2026 security updates to every AD CS/Certificate Authority host. Confirm patch presence by verifying the updated certpdef.dll validation logic rather than relying on general OS patch level alone.
- Apply the interim mitigation only if patching is delayed, and test in a non-production environment first: disable the vulnerable chase fallback with certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC followed by Restart-Service CertSvc -Force. This can break legitimate certificate enrollment workflows that rely on the chase mechanism, so validate impact before production rollout.
- Reduce machine-account creation exposure: audit and, where feasible, lower ms-DS-MachineAccountQuota from its default value of 10 to limit the ability of low-privileged users to create computer accounts usable in this attack chain.
- Hunt for prior abuse: review AD CS/CA request logs for certificate issuances tied to Domain Controller identities requested from newly created, rarely used, or otherwise anomalous computer accounts, particularly for the default Machine template. Review Domain Controller replication logs (Event ID 4662 with directory replication rights) for DCSync-consistent activity from unexpected source accounts, and check for signs of Golden Ticket use given the roughly two-month window between Microsoft’s May confirmation and the July patch.
- Monitor network paths to CA infrastructure: alert on unexpected outbound SMB (445) and LDAP (389) connections from CA servers to non-Domain-Controller hosts, which would indicate an in-progress chase-abuse attempt.
- Review certificate template permissions: confirm which security principals can enroll in the default Machine template and other sensitive templates, and tighten ACLs where enrollment rights exceed operational need.
2026 Cyber Threat Landscape Report
In a time of increasing cyber threats and AI-driven attacks, security teams need actionable insights to drive a preemptive cyberdefense strategy. This report analyzes global risks and offers the intelligence needed for a proactive cybersecurity strategy.
Download report
