Active Directory Users With Minimal Privileges Can Exploit Certighost for Elevated Trust

Security researchers H0j3n and Aniq Fakhrul have publicly released a proof-of-concept exploit for a newly disclosed Active Directory Certificate Services (AD CS) vulnerability dubbed Certighost. The flaw allows a low-privileged domain user to obtain a certificate for a legitimate Domain Controller (DC) and authenticate as that system, potentially leading to full domain compromise.

Microsoft addressed the vulnerability on July 14, 2026, under CVE-2026-54121, classifying it as an improper authorization issue and assigning it a CVSS score of 8.8. However, the publication of a working exploit significantly increases the urgency for organizations that have not yet applied the available security updates.

How the Vulnerability Works

The attack targets environments running Active Directory Certificate Services (AD CS) with an Enterprise Certificate Authority (CA). Under vulnerable conditions, a standard authenticated domain user can manipulate the certificate enrollment process and convince the CA to issue a certificate associated with a Domain Controller.

Notably, the attack does not require:

• Administrative privileges
• User interaction
• Existing elevated access

The only prerequisites are:

• Network connectivity to the target environment
• A valid domain account
• A vulnerable AD CS deployment
• Access to create or control a computer account within Active Directory

In many environments, ordinary users can create computer accounts due to the default ms-DS-MachineAccountQuota setting, which typically allows users to add up to ten machine accounts to the domain.

Exploiting Certificate Enrollment Trust

Researchers discovered that the Certificate Authority trusted network information supplied during certificate enrollment without adequately verifying that the referenced system was a legitimate Domain Controller.

Specifically, the attack abuses attributes used during the enrollment process:

• cdc (Certificate Domain Controller)
• rmd (Resolved Machine Directory object)

The CA follows these supplied references using SMB and LDAP communications but, in vulnerable versions, failed to properly validate the authenticity of the destination server before proceeding.

An attacker can exploit this behavior by:

1. Creating or controlling a machine account.
2. Hosting rogue SMB and LDAP services.
3. Intercepting the CA's validation requests.
4. Relaying authentication traffic to a real Domain Controller through Netlogon.
5. Returning legitimate Domain Controller attributes such as:
   • objectSid
   • dNSHostName
6. Convincing the CA that it is communicating with a trusted Domain Controller.

As a result, the CA issues a certificate containing the identity of the targeted Domain Controller rather than the attacker's machine.

From Certificate Abuse to Domain Compromise

Once the forged certificate is obtained, the attacker can leverage Public Key Cryptography for Initial Authentication (PKINIT) to authenticate as the targeted Domain Controller.

This is particularly dangerous because Domain Controllers possess highly privileged directory replication rights.

Using the resulting Kerberos credentials, attackers can perform a DCSync attack, allowing them to retrieve sensitive account secrets directly from Active Directory.

Among the most valuable credentials that can be extracted is the krbtgt account secret, which underpins Kerberos authentication throughout the domain.

Compromise of the krbtgt account can enable attackers to:

• Forge Golden Tickets
• Establish persistent domain-wide access
• Impersonate any user
• Maintain long-term control of the Active Directory environment

Public Exploit Automation

The released proof-of-concept automates the entire exploitation chain.

The tool can:

• Create a new machine account or use an existing attacker-controlled account
• Launch SMB and LDAP listeners on ports 445 and 389
• Relay CA authentication traffic to a legitimate Domain Controller
• Submit malicious certificate enrollment requests
• Generate a certificate package (PFX)
• Create a Kerberos credential cache for immediate use

This significantly lowers the technical barrier to exploitation for attackers targeting vulnerable environments.

Microsoft's Mitigation and Security Update

Microsoft's July 2026 patch introduces additional validation checks within the certificate enrollment process.

Researchers analyzing the updated binaries found a new validation routine that:

• Rejects malformed or suspicious hostnames
• Blocks IP-address-based enrollment targets
• Filters LDAP metacharacters
• Ensures exactly one matching computer object exists in Active Directory
• Verifies DNS consistency
• Confirms the target account possesses the SERVER_TRUST_ACCOUNT flag
• Performs additional SID validation to prevent object substitution attacks

These protections prevent attackers from impersonating arbitrary Domain Controllers during certificate enrollment.

Affected Systems

The vulnerability has been demonstrated in environments featuring:

• Active Directory Certificate Services (AD CS)
• Enterprise Certificate Authorities
• Default Machine certificate templates
• Default machine account quotas

Microsoft's affected products include various Windows Server versions, including:

• Windows Server 2012
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025
• Server Core deployments

Certain Windows 10 enterprise editions are also listed among affected platforms.

Temporary Mitigation for Unpatched Systems

Organizations unable to deploy the July updates immediately may consider disabling the vulnerable certificate chase functionality.

Researchers tested the following mitigation in a lab environment:

However, they caution that this workaround may disrupt legitimate certificate enrollment processes and should be thoroughly tested before deployment in production environments.

Conclusion

The Certighost vulnerability demonstrates how weaknesses in Active Directory Certificate Services can be leveraged to achieve complete domain compromise. By abusing trust relationships during certificate enrollment, a low-privileged user can obtain Domain Controller authentication certificates, perform DCSync attacks, and ultimately extract highly sensitive credentials such as the krbtgt secret. With a public proof-of-concept now available, organizations operating Enterprise Certificate Authorities should prioritize deploying Microsoft's July 2026 security updates and review AD CS configurations to ensure they are not exposed to this high-impact attack path.