Certighost Exploit for AD CS Flaw CVE-2026-54121 Released

Executive Summary

Security researchers have publicly released a proof-of-concept (PoC) exploit for a critical vulnerability in Microsoft's Active Directory Certificate Services (AD CS). The vulnerability, dubbed "Certighost" and tracked as CVE-2026-54121, has a CVSS score of 8.8. The exploit allows a low-privileged domain user to obtain a certificate for a Domain Controller (DC), enabling them to authenticate as the DC and compromise the entire Active Directory domain. The attack abuses a fallback mechanism in the AD CS enrollment process. Microsoft patched the flaw in its July 2026 security updates, but the release of a functional PoC dramatically increases the urgency for organizations to apply the patch to their Certificate Authority servers.

Vulnerability Details

The Certighost vulnerability lies in a specific AD CS enrollment process known as a "chase." It allows a low-privileged attacker to manipulate the certificate request process to impersonate a high-privilege machine, such as a Domain Controller.

• CVE ID: CVE-2026-54121
• CVSS Score: 8.8 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Standard Domain User)
• User Interaction: None

Attack Chain:

1. An attacker with a standard domain user account crafts a specific certificate request.
2. In the request, they supply attributes that trick the Certificate Authority (CA) into contacting an attacker-controlled server for identity information about a legitimate DC.
3. The CA receives malicious identity data from the attacker's server.
4. Believing the data is legitimate, the CA issues a valid certificate for the Domain Controller to the attacker.
5. The attacker uses this certificate to authenticate as the DC (T1649 - Steal or Forge Authentication Certificates).
6. With DC-level privileges, the attacker can perform a DCSync attack (T1003.006 - DCSync) to dump all domain credentials, including the krbtgt hash, leading to full domain compromise.

Affected Systems

• Product: Microsoft Active Directory Certificate Services (AD CS)
• Vulnerable Configuration: An Enterprise CA that uses the default "Machine" certificate template.
• Operating Systems: Windows Server 2012 through 2025, and some versions of Windows 10.

Exploitation Status

As of July 24, 2026, a functional proof-of-concept exploit has been published on GitHub. While there are no public reports of in-the-wild exploitation yet, the availability of the PoC means that threat actors will likely begin incorporating it into their toolkits immediately. The risk of exploitation is now significantly elevated for any organization with a vulnerable AD CS configuration.

Impact Assessment

The impact of a successful Certighost exploit is a full compromise of the Active Directory domain. This is one of the most severe security outcomes possible in a Windows environment. An attacker with the krbtgt hash can create Golden Tickets, allowing them to impersonate any user or service in the domain indefinitely, even if passwords are changed. This provides complete, persistent, and difficult-to-detect control over the entire network. The low privilege requirement for the attacker makes this an extremely dangerous vulnerability.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

• Log Source: Certificate Authority logs (Event IDs 4887, 4888, 4898 on the CA server), Security logs on Domain Controllers.
• Network Traffic: Monitor for unusual LDAP or RPC traffic from the CA server to non-DC endpoints, which could indicate the CA is being tricked into contacting an attacker's machine.
• Certificate Templates: Audit AD CS for the use of the default "Machine" certificate template and other templates that allow for subject name to be supplied in the request.
• Event ID: Look for Event ID 4769 (A Kerberos service ticket was requested) on Domain Controllers where the Service Name is a DC and the Client Address is not a legitimate DC or administrative host.

Detection Methods

• Certificate Monitoring: Monitor for the issuance of certificates for Domain Controllers. Any such certificate issued to a non-DC machine or requested by a non-privileged user is a major red flag. This can be achieved by analyzing CA audit logs.
• Log Analysis: Correlate logs between the CA and DCs. A certificate request logged on the CA for a DC should correspond with legitimate activity on that DC. Discrepancies could indicate an attack.
• DCSync Detection: Use security tools to monitor for DCSync activity from non-authorized sources. Any machine other than a DC performing a DCSync request is a sign of compromise.

Remediation Steps

1. Apply Security Updates: The primary remediation is to install the July 2026 Microsoft security updates on all Active Directory Certificate Services hosts. The patch adds a validation step to ensure the host in the request is a legitimate DC. This is a direct application of D3-SU: Software Update.
2. Harden Certificate Templates: As a defense-in-depth measure, review and harden AD CS certificate templates. Disable templates that are not needed and configure those that are to require manager approval and not allow the subject name to be supplied in the request. This aligns with M1054 - Software Configuration.
3. Restrict Enrollment: Limit which users and machines can enroll for which certificates. Standard users should not be able to request certificates that could be used for machine authentication.