Certighost (CVE-2026-54121): Any Domain User to Full Domain Compromise in Four Steps — Working Exploit Published Today, Patch Your AD CS Servers Now

Sources: H0j3n GitHub writeup (CVE-2026-54121.md — primary technical disclosure) · The Hacker News · CybersecurityNews · Cyber Kendra · SudoFlare · QPulse · Windows News | CVE: CVE-2026-54121 | Name: Certighost | CVSS: 8.8 — High | CWE: CWE-285 — Improper Authorization | Discovered by: H0j3n and Aniq Fakhrul | Reported to Microsoft: May 2026 | Patched: July 14, 2026 | PoC published: July 24, 2026 | Affected: All supported Windows Server versions with AD CS role | Prerequisites: Network access + any domain account — no admin rights, no user interaction | Wild exploitation: None confirmed | Attack outcome: Full Active Directory forest compromise via krbtgt → Golden Ticket

Any domain account. No admin rights. Four steps to full Active Directory forest compromise. Working public exploit published today.

On July 24, 2026, security researchers H0j3n and Aniq Fakhrul published a working proof-of-concept exploit for CVE-2026-54121 — a flaw in Active Directory Certificate Services (AD CS) they named Certighost. The exploit demonstrates a four-step chain: any low-privileged domain user obtains a Domain Controller machine certificate via an obscure AD CS enrollment fallback, authenticates as a Domain Controller using that certificate, DCSync’s the krbtgt hash from Active Directory, and forges Golden Tickets that authenticate as any user in the entire forest indefinitely. Microsoft patched the vulnerability on July 14, 2026. No exploitation in the wild has been confirmed — but a working public exploit with full technical documentation means that window is closing fast.

CVSS 8.8 understates the real severity. The score reflects “High” impact on a per-system basis. A successful Certighost exploit doesn’t compromise one system — it compromises every identity in the entire Active Directory forest. krbtgt is the master key of Kerberos. Golden Tickets forged from krbtgt authenticate as any user, to any service, indefinitely, with no way to revoke them without resetting krbtgt twice — which temporarily breaks Kerberos authentication across the entire domain. Some security professionals have argued the score should be Critical for this reason, noting the CVSS framework’s per-system impact model understates forest-wide compromise scenarios.

What AD CS does — and what a “chase” is

Active Directory Certificate Services is Microsoft’s built-in public key infrastructure — the system that issues digital certificates inside a corporate domain. Certificates serve as digital ID cards: a Certification Authority (CA) signs them, binding a public key to an identity that other services can trust. One critical use case is certificate-based Kerberos authentication (PKINIT): a client requests a certificate, then presents it to the Key Distribution Center (KDC) to obtain a Kerberos ticket. Domain Controllers use machine certificates for exactly this purpose.

The Certighost vulnerability lives in an obscure enrollment fallback called a “chase” — a second directory lookup the CA performs during certain cross-domain certificate requests. From H0j3n’s own GitHub writeup: “The vulnerable path is an AD CS enrollment fallback known as a chase during directory-object resolution. By supplying request attributes such as cdc, an attacker could cause the Certification Authority to ask an attacker-controlled host for identity data belonging to a Domain Controller. The CA then used that data while issuing a certificate.” The fix: “a chase endpoint is no longer accepted merely because it responds as a domain principal.”

The four-step exploit chain

Step 1 — cdc chase abuse → Domain Controller certificate

An attacker with any domain account — obtained through phishing, password spray, credential theft, or any other means — submits a certificate enrollment request to the CA with a crafted cdc (chase domain controller) attribute pointing to attacker-controlled infrastructure. The CA follows the chase, contacts the attacker’s host, receives fabricated Domain Controller identity data, and issues a Domain Controller machine certificate to the attacker. Before the July 14 patch, the CA verified only that the cdc target responded as a domain principal — not that it was actually a real Domain Controller with the SERVER_TRUST_ACCOUNT flag set in Active Directory.

Step 2 — PKINIT → Kerberos TGT as Domain Controller

The attacker presents the fraudulently issued Domain Controller certificate to the Key Distribution Center using PKINIT (certificate-based Kerberos authentication). The KDC validates the certificate — it was signed by the CA, so it passes — and issues a Kerberos Ticket Granting Ticket (TGT) authenticating the attacker as the Domain Controller machine account. The attacker is now, from Kerberos’s perspective, a Domain Controller.

Step 3 — DCSync → krbtgt hash

Domain Controller machine accounts carry directory replication rights — the permissions that allow DCs to synchronize the AD database with each other. The attacker uses these rights to perform a DCSync attack, requesting replication of specific Active Directory objects from a real DC. The target: the krbtgt account. DCSync pulls the krbtgt NTLM hash and AES keys — the cryptographic secrets the KDC uses to sign every Kerberos ticket in the domain.

Step 4 — Golden Ticket → unlimited forest access

With the krbtgt hash, the attacker uses Mimikatz or an equivalent tool to forge Golden Tickets — Kerberos TGTs crafted offline that authenticate as any user in the domain, including Domain Admins, with any group memberships, for any service, with any expiry date the attacker chooses. Golden Tickets are valid until krbtgt is rotated — and cannot be revoked without rotating krbtgt twice (24+ hours apart), which temporarily breaks Kerberos authentication across the entire domain for all users and services.

The patch — what Microsoft changed in certpdef.dll

Microsoft’s July 14 fix adds a new validation function, CRequestInstance::_ValidateChaseTargetIsDC, to certpdef.dll, gated behind servicing flag Feature_3185813818. From CybersecurityNews’s analysis of the patch: before the CA follows a cdc target, it now queries AD to confirm the target is a real computer object with the SERVER_TRUST_ACCOUNT flag (value 8192), performs a follow-up SID comparison to prevent object substitution, and only after these checks pass does the CA proceed with the chase and certificate issuance. A cdc target is no longer trusted merely because it responds as a domain principal — it must be verifiably a genuine DC in Active Directory.

Why AD CS keeps being the attack surface

Certighost is the latest in a line of AD CS attacks that have defined enterprise Active Directory security since SpecterOps published “Certified Pre-Owned” in 2021, documenting ESC1 through ESC8. Subsequent research extended the catalog to ESC15. The reason the arc continues: AD CS is complex, poorly understood by most AD administrators, its attack surface is not covered by standard security tooling, and CA servers are frequently underpatched relative to Domain Controllers because they are treated as infrastructure components rather than primary security targets.

The cdc chase path that Certighost abuses is an obscure enrollment fallback that almost no security monitoring is tuned to detect. Certificate enrollment request anomalies — the specific signal that would catch Certighost — are not in most EDR or SIEM rulesets. The attack generates no unusual authentication events until the DCSync step, which can be masked as legitimate replication traffic. A domain account sufficient to launch the attack is available to any attacker who has achieved the most basic level of access to the corporate network.

Immediate actions — the complete checklist

1. Patch all AD CS servers with the July 14, 2026 security update. This is your CA server(s) — not your Domain Controllers. Verify the patch landed on the CA role specifically: the updated file is certpdef.dll. Check update history on each CA server.
2. If you cannot patch immediately: Disable the vulnerable cdc chase path on every CA server:
   certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
net stop certsvc && net start certsvc
   This is an emergency measure only — apply the patch as soon as possible.
3. Find all your CA servers. Many organizations have shadow CAs installed for specific purposes and forgotten. Query AD: Get-ADObject -SearchBase "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=com" -Filter * -Properties *. Every unpatched CA is a Certighost entry point.
4. Audit for exploitation indicators. Check AD CS logs for certificate requests containing a cdc attribute pointing to non-DC hosts. Check for unexpected Domain Controller machine certificates issued to non-DC accounts in the past 60 days. Review DCSync activity in DC security logs for unexpected replication requests (Event ID 4662 with Replicating Directory Changes rights).
5. Rotate krbtgt twice if you have any uncertainty about prior exploitation. First rotation (immediate): invalidates all existing TGTs. Second rotation (24+ hours later): ensures all tickets issued from the compromised krbtgt are expired. Plan your maintenance window — this is temporarily disruptive.
6. Audit AD CS template permissions with Certipy or Certify. While you have attention on the CA servers, audit the broader ESC1–ESC15 attack surface. Certighost is one attack path; the underlying AD CS exposure is almost certainly wider.

Sources and further reading

• H0j3n — CVE-2026-54121.md — Certighost Primary Technical Disclosure (GitHub)
• The Hacker News — Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
• CybersecurityNews — Certighost Active Directory CS Exploit Allows Low-Privileged Users to Compromise Domain
• Cyber Kendra — New “Certighost” Flaw Lets Any Domain User Seize Full Windows Domain
• SudoFlare — Certighost Exploit 2026: Any User Can Hijack Active Directory
• Windows News — Microsoft’s July 2026 Update Fixes AD CS Flaw — Patch Immediately

DataWater publishes daily cybersecurity intelligence for enterprise and government security leaders. Article #47 — July 24, 2026. Previous: ExploitGym Incident (July 23) · HollowGraph (July 20) · wp2shell (July 17). Full archive →