Domain Takeover Alert: Public "Certighost" Exploit Forges Active Directory DC Certificates
Executive Summary
Security researchers have publicly released full technical details and a fully functional proof-of-concept (PoC) exploit tool, dubbed "Certighost," targeting a high-severity vulnerability in Microsoft Active Directory Certificate Services (AD CS). The flaw, tracked as CVE-2026-54121 with a CVSS score of 8.8, was patched by Microsoft in its July 14, 2026 Patch Tuesday update.
Certighost enables any standard, low-privileged domain user—without requiring administrative rights or victim interaction—to trick an Enterprise Certification Authority (CA) into issuing a legitimate x509 digital certificate carrying the identity of a Domain Controller (DC). Armed with this forged DC certificate, an adversary can authenticate as the DC via Kerberos PKINIT, execute DCSync operations, exfiltrate the krbtgt password hash, and forge Golden Tickets for permanent, domain-wide takeover.
Technical Deep Dive & Attack Mechanics
CVE-2026-54121 targets an AD CS enrollment fallback mechanism known as a "chase" during directory-object resolution. When an Enterprise CA receives a certificate enrollment request and cannot directly resolve an entity's directory identity, it uses requester-supplied attributes—specifically cdc (the Active Directory server to contact) and rmd (the target machine object to resolve)—to locate the identity.
The vulnerable AD CS implementation followed the requester-supplied cdc host parameter over SMB and LDAP without validating that the target host was a genuine, trusted Domain Controller. The "Certighost" attack chain exploits this design flaw through four distinct technical stages:
Stage
Action
Technical Description
1
Machine Account Provisioning
A standard domain user creates a computer account in Active Directory (allowed by default ms-DS-MachineAccountQuota of 10).
2
Rogue Listener Deployment
The attacker sets up rogue SMB/LSA and LDAP listeners on an attacker-controlled machine.
3
Identity Relay & Spoofing
The attacker submits a certificate request to the CA, specifying the rogue host. The CA's challenge is relayed to a real DC over Netlogon.
4
Certificate Issuance
The Enterprise CA signs a certificate with the DC's identity. Attacker uses PKINIT to run DCSync and pull secrets.
Industry Impact & Threat Landscape
Active Directory Certificate Services (AD CS) serves as the foundational Public Key Infrastructure (PKI) backbone for device authentication, smart cards, and single sign-on (SSO) across enterprise Windows environments. Because "Certighost" weaponizes default AD configurations and standard user accounts, any compromised employee endpoint can immediately become a launchpad for full Active Directory forest takeover.
While active in-the-wild exploitation was not recorded prior to disclosure, the publication of the functional "Certighost" PoC tool on GitHub drastically lowers the barrier to entry for ransomware syndicates and nation-state threat groups. Organizations that delay applying July 2026 patches face immediate risk of rapid post-compromise lateral movement.
Recommendations & Mitigation Strategies
Enterprise Active Directory administrators must prioritize the following defense and remediation measures:
* Apply July 2026 Security Updates: Immediately install Microsoft's July 14, 2026 security patches for CVE-2026-54121 across all Enterprise CAs and Domain Controllers.
* Restrict Machine Account Creation: Set ms-DS-MachineAccountQuota to 0 domain-wide to prevent standard domain users from creating machine accounts without administrative approval.
* Harden AD CS Enrollment Templates: Review and restrict certificate templates that allow ENROLLEE_SUPPLIES_SUBJECT or permit client-specified SAN/attribute chasing.
* Monitor for DCSync Activity: Enforce strict threat-detection rules for directory replication traffic originating from non-DC IP addresses (Event ID 4662 with Guid 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 for Replication-Get-Changes-All).
* Enforce PKINIT Auditing: Enable Kerberos PKINIT authentication logging (Event ID 4768) and audit certificate usage for anomalous machine accounts requesting DC privileges.
References:
* Public PoC Released for "Certighost" (CVE-2026-54121) - Dataminr
* Public Exploit Enables Domain Controller Impersonation - Field Effect
* Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate DCs - The Hacker News