Active Directory Threat: Public PoC Released for "Certighost" Domain-Takeover Flaw CVE-2026-54121
Executive Summary
On July 27, 2026, security researchers publicly released a functional Proof-of-Concept (PoC) exploit script for CVE-2026-54121, colloquially named "Certighost." The vulnerability is a critical privilege escalation flaw in Microsoft Active Directory Certificate Services (AD CS) that enables low-privileged domain users to achieve complete Active Directory domain takeover.
Deep-Dive Technical Analysis
Certighost exploits a fundamental authorization flaw in how AD CS validates certificate requests against misconfigured certificate templates containing the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.
Exploitation walkthrough:
1. Subject Alternative Name (SAN) Injection: A low-privileged domain user requests an X.509 certificate and specifies a Domain Administrator or Domain Controller computer account name in the SAN attribute.
2. Certificate Issuance: Due to improper sanitization in AD CS enrollment logic, the Enterprise CA issues a valid digital certificate carrying elevated SAN credentials.
3. Kerberos Authentication: The attacker uses the malicious certificate to request a Kerberos Ticket Granting Ticket (TGT) via PKINIT as the Domain Administrator, instantly escalating privileges to full forest admin control.
With the release of a reliable public exploit, automated scanning by threat actors seeking AD CS targets is expected to surge dramatically.
Industry Impact & Recommendations
Active Directory Certificate Services misconfigurations remain one of the most reliable and stealthy post-compromise attack vectors in enterprise Windows environments.
Essential mitigation steps for Windows domain administrators:
* Apply the latest Microsoft Security Updates addressing CVE-2026-54121 across all Enterprise Certificate Authorities.
* Run automated AD CS auditing tools (such as Certify or PSPiaK) to detect and disable templates configured with dangerous supply-subject-in-request settings (ENROLLEE_SUPPLIES_SUBJECT).
* Enforce strong Certificate Revocation List (CRL) checking and restrict Enrollment Agent certificate rights.
* Monitor Active Directory event logs (Event IDs 4886 and 4887) for anomalous SAN certificate requests.