A proof-of-concept (PoC) exploit for **Certighost**, a significant vulnerability within **Windows Active Directory Certificate Services (AD CS)**, has been released, enabling authenticated attackers to potentially compromise a Windows domain. Identified as **CVE-2026-54121**, the flaw was addressed by **Microsoft** as part of their **July 2026 Patch Tuesday** security updates. "An authenticated attacker could manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via PKINIT," **Microsoft** explained. If the attacker targets a domain controller account, **Microsoft** warns that they could authenticate as the domain controller and execute privileged Active Directory operations. Security researchers **H0j3n** and **Aniq Fakhrul** reported the vulnerability to **Microsoft** on May 14, 2026, leading to its fix in the subsequent July security updates. Last week, the researchers publicly disclosed the technical intricacies of the vulnerability, including the release of an exploit capable of achieving domain-level administrative capabilities. "Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration," states the [researchers' technical writeup](https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26). ## Abusing the AD CS Chase Mechanism **Active Directory Certificate Services (AD CS)** serves as **Microsoft's** public key infrastructure for Windows domains, facilitating the issuance of certificates for authentication and secure communications. During certificate-based authentication, the domain controller verifies the Active Directory account linked to the certificate before issuing Kerberos credentials. **Certighost** exploits a fallback mechanism within **AD CS** during certificate enrollment requests, which the researchers term a "chase." This mechanism relies on two certificate request values: * `cdc`, or Client DC, which specifies the server the Certification Authority (CA) should contact. * `rmd`, or Remote Domain, which identifies the account the CA should search for. When both attributes are provided, the CA connects to the server designated by the `cdc` value and searches for the `rmd`. Crucially, prior to the patch, systems did not verify that the server supplied via the attacker-controlled `cdc` value was a legitimate domain controller. This oversight allowed an attacker to operate rogue **SMB**, **LSA**, and **LDAP** services, direct the CA to their controlled system, and return false directory information for a targeted machine account.  **Certighost attack flow** *Source: H0j3n and Aniq Fakhrul* In the attack demonstrated by the researchers, a low-privileged user initially creates a machine account, a permissible action under the default `ms-DS-MachineAccountQuota` configuration. "A machine account created through the default `ms-DS-MachineAccountQuota` setting is a valid domain principal," the report clarifies. "This allowed the attacker-controlled chase endpoint to satisfy the authentication checks needed for the CA to continue, even though it was not the Domain Controller being impersonated." The attacker then submits a certificate request, directing the CA to the rogue services and targeting a domain controller account. Because the CA trusts the identity information provided by the attacker-controlled services, it issues a certificate that can then be used to authenticate as that domain controller and perform Active Directory operations. The released `certighost.py` proof-of-concept ([available on GitHub](http://github.com/aniqfakhrul/CVE-2026-54121)) automates this process. It uses the certificate to authenticate via **PKINIT** as the targeted domain controller, saves the resulting Kerberos credentials to a `.ccache` file, and extracts the account’s **NT hash**. The researchers further demonstrated using the saved Kerberos credentials with **Impacket's secretsdump** tool to execute a **DCSync** attack and retrieve the `krbtgt` account's credentials. "A Domain Controller account has directory replication rights. With the resulting Kerberos credential, the attacker can request account secrets, including the `krbtgt` secret," the researchers explained.  **Using the DC's Kerberos credentials to perform a DCSync attack** *Source: H0j3n and Aniq Fakhrul* **Microsoft** rectified the vulnerability as part of the **July Patch Tuesday** updates by incorporating validation into this chase process. The CA now verifies that the server specified in the `cdc` attribute maps to a legitimate domain controller in Active Directory and confirms that the returned identity matches the expected account. For administrators unable to install the July security updates immediately, the researchers suggest disabling the optional chase fallback using the following commands: However, the researchers emphasize that this workaround is only a temporary mitigation and has not been thoroughly tested in production environments. Therefore, administrators should prioritize installing the latest security updates as soon as possible.