It’s shocking how a low‑privileged Active Directory account can masquerade as a Domain Controller. That’s the core of the Certighost exploit released on July 24, 2026. Researchers H0j3n and Aniq Fakhrul showed a working chain that hands a regular “Domain Users” account a certificate for a DC, then lets it pull the krbtgt secret via DCSync.
Key Takeaways
- Low‑privileged users can obtain a DC‑level certificate without admin rights.
- Exploitation hinges on a vulnerable AD CS chase fallback that trusts attacker‑supplied hosts.
- Microsoft patched the issue (CVE‑2026‑54121) on July 14, but the public PoC is still out.
- Mitigation without patching involves clearing the chase flag, a step that can break legit enrollments.
- No public reports of wild exploitation yet, but the proof‑of‑concept is fully available.
Historical Context
The journey to this disclosure began months earlier. In early May, the two researchers identified an abnormal path in the AD CS enrollment flow. By May 14 they had a reproducible proof of concept and reached out to Microsoft. The vendor responded within a week, confirming the vulnerability on May 22. That quick turnaround is typical for high‑severity flaws, especially those that affect core authentication services.
During the same period, Microsoft was already hardening other legacy protocols. Netlogon, SMB, and LDAP have each been the focus of separate mitigations in recent years. The Certighost chain builds on this history, showing how a seemingly harmless fallback can be weaponized when the surrounding checks are missing. The chase fallback itself has existed for a long time, designed to keep certificate enrollment working when the primary DC cannot be reached. Its convenience became its Achilles’ heel when an attacker could control the target host.
When the July 14 patch arrived, it introduced a validation step that mirrors earlier hardening efforts. The new function CRequestInstance::_ValidateChaseTargetIsDC echoes previous checks added for ZeroLogon and PetitPotam, where Microsoft forced strict name validation and SID verification. Those earlier patches set a precedent: implicit trust without verification is no longer acceptable. Certighost therefore fits into a broader narrative of shrinking the attack surface around AD CS.
Certighost exploit: how a low‑privileged user hijacks a Domain Controller
When the researchers ran their tool, a normal account under the default ms‑DS‑MachineAccountQuota of 10 could spin up a new computer object or reuse an existing one. The exploit then starts listeners on SMB (port 445) and LDAP (port 389), relays the CA’s authentication challenge to the real DC over Netlogon, and finally writes a PFX file plus a Kerberos credential cache.
Why the chase fallback matters
AD CS uses a “chase” when it can’t pull the end‑entity’s details. The request can specify a cdc (the AD server to contact) and rmd (the machine object to resolve). The CA, instead of verifying that cdc points to a real DC, blindly follows the attacker‑supplied host over SMB and LDAP. That’s the weakness the exploit abuses.
Microsoft’s July 14 update adds a validation function—CRequestInstance::_ValidateChaseTargetIsDC—to certpdef.dll. The code now rejects IP literals, overlong names, and LDAP meta‑characters, and it forces a match against a computer object flagged as a SERVER_TRUST_ACCOUNT (value 8192). A later SID comparison blocks object substitution.
Exploit workflow in plain terms
First, the tool creates or reuses a computer account using the --computer-name flag. Next, it opens SMB and LDAP listeners, waiting for the CA to reach out. When the CA sends its challenge, the tool relays it to the genuine DC via Netlogon, captures the DC’s objectSid and dNSHostName, and feeds those back to the CA. The CA then signs a certificate that embeds the target DC’s identity.
With that certificate, the attacker uses PKINIT to get a Kerberos ticket as the DC. The ticket, in turn, lets the attacker run DCSync and pull the krbtgt secret, effectively breaking the Kerberos trust model.
Patch timeline and lingering risk
Microsoft first patched the AD CS issue on July 14, assigning it CVE‑2026‑54121 with a CVSS score of 8.8. The flaw sits in AD CS enrollment fallback, so the patch adds the needed validation. The researchers reported the flaw on May 14, got confirmation on May 22, and disclosed it publicly on July 24.
Even with the patch, organizations running an Enterprise CA still need to apply the July 14 updates on AD CS hosts. The original report notes that as of July 24, no primary source had seen wild exploitation, but the public PoC means an attacker could still try it on unpatched systems.
- Patch release date: July 14, 2026
- CVE: CVE‑2026‑54121
- CVSS: 8.8 (improper authorization)
- Affected OS: Windows Server 2012‑2025, Windows 10 1607/1809
- Required conditions: network access, domain account, Enterprise CA with default Machine template
Work‑around for environments that can’t patch immediately
If you can’t roll out the July update right away, the researchers suggest clearing the chase flag and restarting the Certificate Services. The command looks like this:
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC Restart-Service CertSvc -Force
They warned that this mitigation was only tested in a controlled lab and could break legitimate enrollment flows. So you’d need to stage it carefully and treat the July update as the permanent fix.
Impact on Kerberos and DCSync defenses
Because the exploit hands the attacker a Kerberos credential that looks like it came from a DC, it sidesteps typical DCSync detection that expects a regular computer account to request the krbtgt secret. That’s why the CVSS rating sits at 8.8—this isn’t just privilege escalation; it’s a full‑blown trust compromise.
Organizations that rely on Kerberos‑based segmentation need to reassess their monitoring. Look for unusual PKINIT tickets, especially ones that originate from computer objects that suddenly start behaving like DCs.
What This Means For You
If you manage an on‑prem AD environment with an Enterprise CA, you should verify that the July 14 patches are installed on every AD CS host. Run a quick inventory: check the version of certpdef.dll and confirm the CRequestInstance::_ValidateChaseTargetIsDC function exists.
For developers building tools that interact with AD CS, consider adding extra validation on the client side—don’t trust a cdc value without confirming it maps to a trusted DC. And if you can’t patch right now, apply the chase‑flag mitigation only after testing it in a staging environment. That’ll keep your enrollment pipelines alive while you lock down the chase fallback.
Looking ahead, will Microsoft tighten other enrollment pathways that rely on implicit trust? The Certighost chain shows that even legacy protocols can be weaponized, so we’ll likely see more hardening around SMB, LDAP, and Netlogon interactions in future updates.
Concrete Scenarios for Different Stakeholders
Scenario 1 – A small‑to‑medium business with a single IT admin. The admin runs the latest Windows Server patches on the DC but forgets the CA host. An unprivileged user joins the domain, runs the Certighost tool, and gains a DC‑level certificate. The result is a silent compromise that bypasses the limited monitoring the company has in place. The lesson: patch every server that hosts AD CS, not just the core DCs.
Scenario 2 – A SaaS provider that uses an on‑prem Active Directory for internal service accounts. Their CI/CD pipelines frequently create machine accounts to support automated deployments. Because the default ms‑DS‑MachineAccountQuota is ten, the pipeline can spin up new computer objects on demand. If an attacker injects the Certighost binary into a compromised build runner, they could hijack one of those temporary accounts, request a DC certificate, and then extract the krbtgt secret. This would give the attacker the ability to impersonate any service that relies on Kerberos tickets.
Scenario 3 – A security vendor developing a detection platform. Their product currently flags DCSync activity originating from standard computer objects. With Certighost, the source appears as a legitimate DC, causing the alert to miss the breach. The vendor must now expand rule sets to include anomalous PKINIT ticket requests and monitor for unexpected chase‑fallback activity on ports 445 and 389. Adding these checks will close the blind spot that Certighost creates.
Key Questions Remaining
What other fallback mechanisms in AD CS remain unchecked? The chase fallback was the most visible, but similar “best‑effort” paths exist for other templates. Will Microsoft release a broader hardening that enforces verification across all templates? That question drives future research.
Can defenders rely on network‑level controls alone to stop the exploit? The tool uses SMB and LDAP, both of which are often allowed between domain‑joined machines. Segmenting those ports may raise operational friction, yet it could reduce the attack surface. Balancing security and usability will be a recurring theme.
How quickly will threat actors adopt the public PoC? The CVSS score of 8.8 suggests a high incentive, but the requirement for an Enterprise CA narrows the pool of viable targets. Monitoring for early adopters in the wild will be essential for incident response teams.
Will future Windows releases retire the chase fallback entirely? Removing legacy code could eliminate this class of bugs, but it may also break compatibility for older enrollment scripts. The trade‑off will shape the next set of updates from Microsoft.
Sources: The Hacker News, NVD
