Domain Takeover Risk: CertiGhost PoC Exploit Released for Critical AD CS Flaw (CVE-2026-54121)
Executive Summary
On July 27, 2026, security researchers released a fully functional proof-of-concept (PoC) exploit code for a critical Active Directory Certificate Services (AD CS) vulnerability, dubbed CertiGhost and tracked as CVE-2026-54121. The flaw allows unauthenticated remote attackers or low-privileged domain users to exploit misconfigured Certificate Authority (CA) templates and request Kerberos authentication certificates forged with arbitrary Subject Alternative Names (SANs). By requesting a certificate on behalf of high-privilege domain administrator accounts, an attacker can bypass Kerberos authentication checks, extract Ticket Granting Tickets (TGT), and execute instant, full Domain Admin takeover across Windows Active Directory enterprise environments.
Vulnerability ID
Alias
Severity
Affected Component
Release Date
CVE-2026-54121
CertiGhost
Critical
AD CS / Kerberos
July 27, 2026
Deep-Dive Technical Analysis
The root cause of CVE-2026-54121 (CertiGhost) lies in improper access control and validation during certificate enrollment within AD CS web enrollment interfaces and RPC endpoints. When an enterprise CA is configured with certificate templates that allow the enrollee to supply the Subject Alternative Name (EDITF_ATTRIBUTESUBJECTALTNAME2 flag enabled), AD CS relies on input validation routines to ensure standard domain users cannot specify the Security Identifier (SID) or User Principal Name (UPN) of administrative accounts like Domain Admin or KRBTGT.
The public PoC published on July 27 demonstrates a bypass in this validation logic:
1. Attribute Injection: An attacker constructs an RPC enrollment request utilizing specially encoded attributes that evade sanitization filters.
2. SAN Forgery: By embedding UPN=administrator@domain.local within the certificate request attributes, the CA issues an X.509 certificate signed by the trusted enterprise root CA, containing the forged administrative UPN.
3. Kerberos PKINIT Authentication: The attacker uses the issued X.509 client certificate to initiate a Kerberos PKINIT (Public Key Cryptography for Initial Authentication in Kerberos) request to the Domain Controller (DC).
4. TGT Acquisition: The DC trusts the certificate signed by its CA, validates the forged UPN, and responds with a high-privilege Ticket Granting Ticket (TGT), completely bypassing password and MFA restrictions.
Industry Impact and Recommendations
Because Active Directory forms the identity foundation for over 90% of global Fortune 500 networks, the release of a reliable PoC for CVE-2026-54121 poses an immediate, severe threat of automated ransomware deployment and enterprise-wide compromise.
Key Mitigations
* Apply Security Updates Immediately: Deploy Microsoft's latest security updates addressing CVE-2026-54121 on all Active Directory Certificate Services servers and Domain Controllers.
* Audit Certificate Templates: Audit AD CS templates for the EDITF_ATTRIBUTESUBJECTALTNAME2 flag and disable the Supply in Request setting on all authentication-enabled templates.
* Enforce Strong Certificate Binding: Enable Kerberos strong certificate binding on Domain Controllers via registry parameters (StrongNTLMServerThreshold and KdcCertificateMapping) to prevent certificate-based authentication spoofing.
* Monitor PKINIT Events: Set up SOC alerts for Windows Event ID 4768 (Kerberos TGT requested) with public key authentication where the requesting principal differs from the client IP identity.
Review and Authorization
Report Reviewed By: Person
Review Date: Date