A proof‑of‑concept exploit for the Certighost AD CS vulnerability (CVE‑2026‑54121) lets authenticated attackers obtain domain‑controller certificates and potentially take over an entire Windows domain. Microsoft patched the flaw in July 2026, but researchers warn that interim work‑arounds are only temporary.

Key Takeaways

  • Certighost (CVE‑2026‑54121) exploits a fallback chase mechanism in AD CS.
  • A low‑privileged user can create a machine account and obtain a certificate that authenticates as a Domain Controller.
  • Microsoft’s July 2026 Patch Tuesday adds validation to block the chase abuse.

Security researchers H0j3n and Aniq Fakhrul disclosed the Certighost flaw to Microsoft in May 2026. The vulnerability resides in Active Directory Certificate Services (AD CS) when it processes two request attributes: cdc (Client DC) and rmd (Remote Domain). The CA previously trusted the attacker‑controlled cdc value without verifying that it pointed to a legitimate domain controller.

How the Attack Works

Using the default ms‑DS‑MachineAccountQuota setting, a low‑privileged user creates a machine account—considered a valid domain principal. The attacker then submits a certificate request that directs the CA to rogue SMB/LSA/LDAP services via the malicious cdc value and targets a domain‑controller account. Because the CA trusts the returned identity, it issues a certificate that can be used with PKINIT to authenticate as that domain controller.

The released certighost.py PoC automates the process: it obtains the forged certificate, saves Kerberos credentials to a .ccache file, and extracts the account’s NT hash. Researchers demonstrated a DCSync attack with Impacket’s secretsdump to retrieve the krbtgt hash.

Microsoft’s Mitigation

In the July Patch Tuesday updates, Microsoft added validation so the server specified in the cdc attribute must map to an actual domain controller and the returned identity must match the expected account. For environments that cannot immediately apply the patch, researchers suggest disabling the optional chase fallback with:
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force
However, they caution that this is a temporary mitigation and has not been fully tested in production.

Why This Matters

BozokMedia analysis shows that compromising a single machine account can give attackers domain‑wide privileges, making Certighost one of the most critical AD CS flaws of 2026. Organizations that delay patching expose themselves to stealthy credential‑theft attacks that bypass traditional AV solutions.

"If an attacker can forge a machine certificate, they effectively become a trusted domain controller, opening the door to unrestricted AD operations," says cyber‑security analyst Dr. Maya Rao.
Did You Know?: Earlier AD CS bugs also abused fallback mechanisms, but Certighost’s chase logic is more intricate, making detection significantly harder.

Frequently Asked Questions

Q1: Does the exploit require domain‑admin privileges?
A: No. Even a low‑privileged user can trigger the attack by creating a machine account via the default quota.

Q2: Is applying the July 2026 patch enough to fully remediate the risk?
A: The patch addresses the core validation flaw, but legacy systems or mis‑configured work‑arounds may still be vulnerable, so a full update is essential.