Cybersecurity researchers **H0j3n** and **Aniq Fakhrul** have published a working exploit for a critical vulnerability, **Certighost**, impacting **Active Directory Certificate Services (AD CS)**. Disclosed on July 24, the exploit allows a low-privileged **Active Directory** user to obtain a certificate for a **Domain Controller** and subsequently authenticate as that machine. ### The Path to Domain Compromise The **Certighost** flaw, identified as **CVE-2026-54121**, carries a CVSS score of 8.8 and was patched by **Microsoft** ten days prior to the public disclosure. The vulnerability stems from improper authorization within **AD CS**. Exploitation requires network access and a domain account but bypasses the need for administrator rights or user interaction. In their testing, researchers demonstrated that a standard `Domain Users` account could either create a new computer account (leveraging the default `ms-DS-MachineAccountQuota` of 10) or reuse an existing one. ### How Certighost Works The attack chain hinges on a vulnerable **Enterprise CA** configured with the default **Machine** template. The core of the bug lies within an **AD CS** enrollment fallback mechanism known as a 'chase.' When a **Certification Authority (CA)** cannot retrieve an end entity's information, the **Windows** enrollment protocol allows a request to provide `cdc` (the **Active Directory** server to contact) and `rmd` (the machine object to resolve). **H0j3n** and **Aniq Fakhrul** discovered that the **CA** would follow the requester-supplied `cdc` host over **Server Message Block (SMB)** and **Lightweight Directory Access Protocol (LDAP)** without verifying if it was a legitimate **Domain Controller**. This allows an attacker to: 1. Run rogue **Local Security Authority (LSA)** and **LDAP** services. 2. Relay the **CA's** authentication challenge to the real **Domain Controller** via **Netlogon**. 3. Return the target **Domain Controller's** `objectSid` and `dNSHostName`. 4. A controlled machine account provides the necessary valid domain identity for the **CA** to proceed. 5. The **CA** authenticates this controlled account, then signs the target **Domain Controller's** identity into the certificate. This process grants the attacker a Kerberos credential that can then be used to retrieve the `krbtgt` secret through `DCSync`, leading to full domain compromise.  ### The Public Exploit and Mitigation The public exploit, hosted on **GitHub**, automates this entire chain. It creates or reuses a computer account, sets up listeners, relays the **CA's** challenge, and ultimately generates a `PFX` file and Kerberos credential cache. This credential then enables authentication as the target **Domain Controller** using **Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)**. **Microsoft's** July update addresses the vulnerability by introducing `CRequestInstance::_ValidateChaseTargetIsDC` within `certpdef.dll`. This validation ensures that the **CA** only follows legitimate **Domain Controllers** by rejecting IP literals, overlong names, and LDAP metacharacters, and requiring a matching **Active Directory** computer object with the `SERVER_TRUST_ACCOUNT` flag. While no in-the-wild exploitation has been publicly reported as of July 24, the availability of a full proof-of-concept necessitates immediate action. The flaw affects **Windows Server 2012** through **Windows Server 2025**, including **Server Core** editions, and **Windows 10** versions 1607 and 1809. For organizations unable to apply the July updates immediately, a temporary mitigation involves clearing the chase flag and restarting **Certificate Services**: `certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC` `Restart-Service CertSvc -Force` Researchers emphasize that this workaround was only tested in a lab environment and should be staged carefully, with the **Microsoft** July update serving as the permanent fix. The vulnerability was reported to **Microsoft** on May 14, confirmed on May 22, patched on July 14, and publicly disclosed on July 24.