A working proof-of-concept exploit, published on GitHub on 24 July 2026, now lets any low-privilege domain user silently impersonate a Domain Controller, drain your krbtgt hash, and forge Golden Tickets for near-permanent, near-undetectable access — without ever touching an admin account. That is Certighost in a sentence, and with the PoC publicly available, every unpatched Active Directory environment is on borrowed time.

Security researchers H0j3n and Aniq Fakhrul released a working exploit for CVE-2026-54121 (CVSS 8.8) — a flaw in Microsoft’s Active Directory Certificate Services (AD CS) that Microsoft patched on 14 July 2026 as part of Patch Tuesday. The vulnerability turns a standard domain account into a skeleton key for the entire Active Directory forest, and history with similar AD CS research shows threat actors weaponise these chains within days of a public PoC. The timer is running.

Key Takeaways

  • CVE-2026-54121 (CVSS 8.8) — improper authorisation in Active Directory Certificate Services.
  • Any standard domain user can request a certificate that impersonates a Domain Controller — no admin rights needed.
  • Full proof-of-concept publicly released 24 July 2026 on GitHub; exploitation requires no user interaction.
  • Successful attack yields the krbtgt hash, enabling Golden Ticket forging and near-permanent domain persistence.
  • Microsoft patched the flaw on 14 July 2026 (certpdef.dll update); all Windows Server 2012–2025 are affected if unpatched.
  • Not yet on CISA’s KEV list — but the public PoC makes in-the-wild exploitation a matter of when, not if.

What Is Certighost — and Why Is It So Dangerous?

Active Directory Certificate Services is the Microsoft PKI layer that issues digital certificates for users, machines, and services across your enterprise. Organisations depend on it for smart-card logon, device authentication, Wi-Fi, VPN access, and modern Kerberos flows. That deep integration with the identity plane is exactly what makes CVE-2026-54121 so alarming.

The flaw lives in a feature called the “chase” enrollment fallback. When a Certification Authority (CA) cannot immediately resolve an end-entity’s identity from the directory, the Windows enrollment protocol permits the certificate request to supply two optional parameters: cdc — specifying which Domain Controller the CA should contact — and rmd — the machine object to retrieve. The intention is to help the CA find the right object when the directory is partitioned or slow. The fatal assumption: the CA never verified that the host in cdc was actually a legitimate Domain Controller before trusting the identity data it returned.

Certighost exploits this blind trust. The result is what amounts to a certificate-based DCSync — the same technique ransomware operators and nation-state actors use to drain every domain secret in a single operation. According to The Hacker News and CSO Online, the researchers have confirmed this is exploitable against default Active Directory environments with no non-standard configuration required.

The Attack Chain, Step by Step

The full kill-chain requires no special tooling beyond what is now publicly available. Here is exactly what an attacker does:

  1. Create a machine account. Default AD configuration (ms-DS-MachineAccountQuota = 10) allows any domain user to add up to 10 computer accounts — no administrator approval.
  2. Craft a malicious certificate request. The request includes attacker-controlled cdc and rmd parameters pointing to the attacker’s machine, not a real DC.
  3. Stand up rogue LSA and LDAP services. The attacker opens listeners on ports 445 (SMB/LSA) and 389 (LDAP) and relays the CA’s authentication challenge to the real DC via Netlogon.
  4. Return forged identity data. The attacker feeds the CA the real DC’s objectSid and dNSHostName — obtained in the relay. The CA, deceived, signs this identity into the certificate.
  5. Authenticate as the Domain Controller using PKINIT with the fraudulent certificate to obtain a Kerberos TGT for the DC’s machine account.
  6. Execute DCSync and steal krbtgt. DC machine accounts carry directory replication rights. The attacker calls MS-DRSR (the replication protocol) to extract the krbtgt hash plus every other privileged secret in the directory.
  7. Forge Golden Tickets. With krbtgt in hand, the attacker can impersonate any user in the domain, indefinitely — until the krbtgt password is rotated twice.

The entire sequence is unauthenticated at the start, network-accessible, and requires no user interaction. Details are on GitHub at H0j3n/CVE-2026-54121.

Affected Versions

Platform Affected Versions Patch Status
Windows Server (AD CS role) 2012, 2012 R2, 2016, 2019, 2022, 2025 — all editions including Core Patch available — July 14, 2026
Windows 10 Versions 1607 and 1809 running CA role Patch available — July 14, 2026
Fix detail certpdef.dll updated with _ValidateChaseTargetIsDC — CA now validates that cdc resolves to a legitimate DC before processing the chase

Why the Public PoC Changes Everything

Until July 24, CVE-2026-54121 was a serious but largely theoretical risk — a known flaw with a patch. The public PoC release is the inflection point. History with comparable AD CS research is instructive: SpecterOps’ 2021 “Certified Pre-Owned” paper spawned an entire ecosystem of AD CS exploitation (ESC1 through ESC15), with each new variant quickly operationalised by ransomware affiliates and APT groups. The Certighost chain is especially attractive to attackers because:

  • Low barrier: Any domain account, no admin rights, no special tools beyond the public PoC.
  • EDR-invisible: The attack operates entirely in the certificate enrollment and Kerberos authentication planes — no process injection, no shellcode, no obvious lateral movement that endpoint tools typically detect.
  • Long-lived persistence: Golden Tickets forged from a stolen krbtgt survive patching unless the account is rotated twice.
  • Broad blast radius: Every domain user, service, and system in the forest is potentially compromised once krbtgt is leaked.

Indian enterprises are disproportionately exposed. India’s rapid enterprise IT modernisation has produced massive Active Directory deployments across BFSI, pharmaceuticals, manufacturing, and government — frequently on default configurations inherited from initial deployments and never subsequently hardened. We have seen this pattern repeatedly in assessments: AD CS servers with broad enrollment rights, ms-DS-MachineAccountQuota at the default of 10, and no audit logging on certificate issuance events. Recent identity-plane attacks against Indian organisations show exactly how quickly credential-based techniques propagate once an initial foothold is established.

What You Should Do — Right Now

Here is the prioritised action plan for every IT and security team running Active Directory Certificate Services:

  1. Patch immediately. Apply the July 14, 2026 cumulative update across all CA servers and Domain Controllers. Do not wait for the next maintenance window — the public PoC eliminates that luxury.
  2. Set ms-DS-MachineAccountQuota to 0. If users do not need to join machines to the domain, remove this right at the domain root. This eliminates one critical prerequisite of the attack chain and is good hygiene regardless of Certighost.
  3. Audit certificate template enrollment rights. Identify who has Enroll permissions on the Machine template and every other template. Restrict to authorised identities only. This closes multiple ESC-family vulnerabilities simultaneously.
  4. Hunt for indicators now. Check CA event logs for Event 4886 (certificate issued) and 4887 (request denied) with anomalous Subject Alternative Name or Subject values. Cross-reference these with computer account creation events (4741), unusual PKINIT authentications (4768), and suspicious directory replication calls (4662).
  5. Rotate krbtgt proactively. If you cannot confirm your environment was not targeted between the PoC publication (July 24) and today, treat it as potentially compromised. Rotate krbtgt twice — Microsoft’s guidance specifies a minimum 10-hour wait between rotations — and force re-authentication for all privileged accounts.
  6. Apply network micro-segmentation. Certighost requires the attacker’s rogue host to be reachable from the CA on ports 445 and 389. A zero-trust network policy that prevents CA servers from initiating outbound connections to arbitrary endpoints would break this chain at the network layer — this is precisely the kind of defence-in-depth architecture that converts a critical vulnerability into a non-event.

Certighost in Context: The Escalating AD CS Threat Landscape

This vulnerability does not exist in isolation. Since SpecterOps’ landmark research in 2021, Active Directory Certificate Services has become one of the most actively exploited attack surfaces in enterprise environments — precisely because it is deeply privileged, widely deployed, and historically under-monitored. CVE-2026-54121 is more serious than most ESC findings because it is a patch-level vulnerability, not a misconfiguration: even organisations that hardened their certificate templates after previous AD CS guidance remain exposed if they missed the July 2026 Patch Tuesday.

The CISA Known Exploited Vulnerabilities catalog has not yet added CVE-2026-54121 as of the time of writing — but given the public PoC, federal agencies and private organisations alike should treat this with KEV-level urgency. Threat actors do not wait for catalogues.

Frequently Asked Questions

Does Certighost affect us if we don’t use AD CS for user authentication?

Yes — if you have an Enterprise CA deployed on Windows Server (even used only for device certificates, Wi-Fi, internal TLS, or code signing), you are potentially vulnerable. The attack targets the CA itself, not a particular authentication flow. If AD CS is installed and unpatched, the risk exists regardless of how you use it.

We applied the July Patch Tuesday. Are we fully protected?

Patching closes the vulnerability going forward. However, if any period elapsed between the PoC release (July 24) and your patch application where the environment was exposed, verify your CA logs for anomalous certificate requests containing unexpected cdc parameters. Also confirm that certpdef.dll is at the patched version on all CA servers — some organisations update DCs before CAs, leaving the critical component vulnerable.

Can our EDR or SIEM detect this attack in progress?

Standard endpoint detection has significant blind spots here. The attack operates in certificate enrollment and Kerberos planes that most EDR products do not instrument. Effective detection requires CA-level audit logging (Events 4886/4887), Kerberos anomaly detection (machine accounts obtaining PKINIT TGTs they should not need), and directory replication monitoring (unexpected DCSync calls from non-DC sources). If your SIEM is not ingesting these event sources, detection is unlikely.

Is there a temporary workaround if we cannot patch immediately?

Researchers documented a flag to disable the chase fallback mechanism via command line. This reduces the attack surface but has not been comprehensively validated in complex production CA environments — disabling chase may break legitimate enrollment workflows for organisations with non-standard configurations. The July 14 patch is the authoritative fix. Use the workaround only under genuine operational constraints, with security monitoring intensified during the interim.

Get Your Active Directory Assessed Before Attackers Do

Certighost is a sharp reminder that Active Directory — the identity backbone of your enterprise — is under sustained, sophisticated attack. One standard domain account plus one missed patch is all it takes to hand over the keys to your entire domain. If you are not certain your AD CS deployment is patched, hardened against the ESC family of attacks, and monitored for certificate-based abuse, the time to find out is now — not after an incident.

Sanjay Seth and the team at P J Networks Pvt Ltd have been securing Active Directory and PKI infrastructure for enterprises across India and the region for over 30 years. We conduct deep-dive AD CS security assessments, uncover misconfigurations before attackers do, and design zero-trust segmentation policies that break attack chains like Certighost at the network layer — before a fraudulent certificate is ever issued.

Request a Free Active Directory Security Assessment →