Domain Escalation: Certighost PoC Released for Active Directory Certificate Services CVE-2026-54121
Executive Summary
A critical security threat has escalated across Microsoft Active Directory (AD) enterprise environments following the public release of a fully functional proof-of-concept (PoC) exploit tool dubbed "Certighost." Developed and published on GitHub by security researchers H0j3n and Aniq Fakhrul on July 24, 2026, Certighost targets CVE-2026-54121 (CVSS 8.8)—a high-severity improper authorization vulnerability in Active Directory Certificate Services (AD CS). Although Microsoft addressed the flaw in its July 14, 2026 Patch Tuesday update, the availability of a weaponized public exploit tool dramatically increases the risk of rapid adoption by ransomware affiliates and nation-state threat actors. The vulnerability allows any low-privileged, authenticated domain user to request and obtain an authentication certificate impersonating a Domain Controller (DC) without administrative rights or user interaction, granting attackers the ability to execute DCSync attacks and harvest the krbtgt account hash for complete domain takeover.
Deep-Dive Technical Analysis
The vulnerability stems from improper access control validation within AD CS Enterprise Certification Authority (CA) deployments when processing certificate request attributes:
1. Flaw Mechanism (CVE-2026-54121): When issuing certificates based on standard, low-privilege user templates, AD CS fails to strictly enforce SAN (Subject Alternative Name) authorization boundaries during enrollment requests. A low-privileged domain user can pass crafted certificate request attributes that request a certificate bound to the identity of an active Domain Controller computer account.
2. Exploitation Execution via Certighost: The Certighost tool automates the exploitation chain:
* Enrollment Request: Connects to the Enterprise CA via RPC/DCOM and submits a PKCS#10 request embedding the target Domain Controller's sAMAccountName and Service Principal Name (SPN).
* Certificate Acquisition: Bypasses authorization gates to receive a valid X.509 certificate signed by the internal CA that asserts Domain Controller identity and contains client authentication EKU (Extended Key Usage).
* DCSync & Credential Harvesting: Uses the forged DC certificate to establish an encrypted Kerberos/PKINIT session with the authentic Domain Controller. Posing as a peer DC, the tool requests Directory Replication Service (MS-DRSR) synchronization via DCSync.
* Secret Extraction: Exfiltrates the krbtgt password hash and Domain Admin hashes directly, enabling the creation of Golden Tickets for persistent, undetectable domain persistence.
3. Affected Architecture: Impact spans all Enterprise CA installations running on Windows Server 2012 through Windows Server 2025 (including Server Core editions) where AD CS is deployed.
Industry Impact and Recommendations / Mitigations
The public release of Certighost presents an immediate threat to corporate infrastructure, as AD CS misconfigurations and privilege escalation vectors remain among the primary targets for lateral movement in modern cyberattacks.
Mandatory Remediation Guidelines
1. Deploy Microsoft July 2026 Security Updates: Immediately install the July 14, 2026 security patches across all Active Directory Certificate Services servers and Domain Controllers to patch the underlying authorization flaw in AD CS.
2. Audit AD CS Certificate Templates: Review and harden active CA templates. Ensure that EDITF_ATTRIBUTESUBJECTALTNAME2 is disabled on all Enterprise CAs, preventing requesters from supplying custom SANs in certificate signing requests.
3. Restrict Enrollment Rights: Enforce strict access control lists (ACLs) on certificate templates. Remove default enrollment permissions for broad groups such as Authenticated Users or Domain Users on high-privilege templates.
4. Monitor DCSync Activity: Enable audit logging for Directory Service access (Event ID 4662) and monitor for anomalous DCSync requests originating from non-DC IP addresses or standard workstation endpoints.
References:
* Public PoC Released for "Certighost" (CVE-2026-54121) - Dataminr