Active Directory Forest Takeover: Working "Certighost" Exploit Released for AD CS Flaw (CVE-2026-54121)
Executive Summary
Security researchers H0j3n and Aniq Fakhrul have published a fully functional working exploit codenamed "Certighost", targeting an improper authorization vulnerability in Active Directory Certificate Services (AD CS). Tracked as CVE-2026-54121 (CVSS 8.8), the flaw allows any unprivileged standard Active Directory user account (Domain Users) to request a computer certificate representing a Domain Controller machine account. By authenticating via Kerberos with the forged certificate, an attacker can immediately initiate directory replication (DCSync) to retrieve the krbtgt password hash and achieve complete Domain Admin takeover.
Threat Attribute
Detail
Vulnerability Identifier
CVE-2026-54121 ("Certighost")
Affected Component
Active Directory Certificate Services (AD CS)
CVSS 3.1 Base Score
8.8 (High) / Exploitation Status: Working Public PoC Released
Prerequisites
Valid Unprivileged Domain Account (Domain Users)
Impact
Instant Domain Controller Impersonation & Full Active Directory Forest Compromise
Technical Deep-Dive into the Certighost Exploit Chain
The Certighost exploit targets the complex intersection between default machine account creation quotas, computer account SAN mappings, and AD CS template enrollment permissions:
1. Default Machine Account Quotas (ms-DS-MachineAccountQuota)
In default Active Directory environments, any standard domain user is permitted to create up to 10 new computer accounts on the domain (ms-DS-MachineAccountQuota = 10). The attacker uses this default privilege to create a custom computer account (e.g., ATTACK-PC$).
2. Machine Certificate Template Request
AD CS frequently hosts machine certificate templates configured with auto-enrollment rights for domain computers (Domain Computers). Using the credentials of the newly created ATTACK-PC$ account, the attacker submits a Certificate Signing Request (CSR) to the AD CS Enterprise CA:
* The Flaw: Due to missing authorization checks in AD CS processing logic (CVE-2026-54121), the CA fails to verify whether the requesting account possesses legitimate authority to assert Subject Alternative Name (SAN) machine identities.
* The Injection: The attacker injects the Kerberos SPN/DNS identity of an active, highly privileged Domain Controller (e.g., DC01.corp.domain) into the certificate request.
3. Kerberos PKINIT Authentication & DCSync Takeover
The Certificate Authority issues a valid X.509 machine certificate signed for DC01$:
1. The attacker presents the certificate to the KDC via Kerberos PKINIT authentication.
2. The KDC validates the CA signature and issues a Kerberos Ticket Granting Ticket (TGT) for the Domain Controller identity.
3. Operating as DC01$, the attacker invokes the DSGetNCChanges RPC API (DCSync) to request the domain master secrets, extracting all user NTLM password hashes from Active Directory.
Structural Risks in Enterprise Identity Infrastructure
Active Directory Certificate Services remains one of the primary targets for internal privilege escalation in corporate networks. Because AD CS bridges X.509 public key infrastructure with legacy Kerberos/NTLM authentication, subtle misconfigurations or logic flaws in CA templates allow attackers to bypass multi-factor authentication and traditional role-based access control (RBAC).
Recommendations and Mitigations
Active Directory administrators must implement emergency remediation controls:
1. Apply Microsoft Security Update: Ensure all Windows Domain Controllers and Active Directory Certificate Services servers are updated with Microsoft's July 2026 security patch.
2. Restrict Machine Account Quotas: Set ms-DS-MachineAccountQuota to 0 across the Active Directory domain to prevent standard users from creating arbitrary computer accounts.
3. Audit AD CS Certificate Template Permissions: Remove ENROLLEES_SUPPLIES_SUBJECT flags from machine templates and enforce strict Manager Approval for enrollment requests.
4. Monitor for Abortive PKINIT Kerberos Requests: Configure Sentinel/SIEM rules to alert on Kerberos Event ID 4768 (TGT requested) where PKINIT authentication is requested by computer accounts from non-standard IP endpoints.