Cybersecurity researchers have disclosed a serious security flaw dubbed Certighost that allows low-privileged Active Directory (AD) users to impersonate a Domain Controller and potentially gain complete control of a Windows domain.
The vulnerability, tracked as CVE-2026-54121, was patched by Microsoft earlier this month. However, the public release of a proof-of-concept (PoC) exploit has increased concerns that unpatched organizations could become targets for attackers.
Public Exploit Raises Urgency
Security researchers H0j3n and Aniq Fakhrul published a working exploit demonstrating how an ordinary domain user can abuse a weakness in Active Directory Certificate Services (AD CS) to obtain a certificate intended for a Domain Controller.
Once the forged certificate is issued, attackers can authenticate as the Domain Controller using Kerberos authentication, potentially allowing them to extract highly sensitive credentials from the domain.
Microsoft classified the vulnerability as an improper authorization flaw and assigned it a CVSS severity score of 8.8.
How the Attack Works
The vulnerability affects the certificate enrollment process within Active Directory Certificate Services.
Researchers discovered that attackers with a standard domain account can exploit weaknesses in the certificate authority’s validation process by creating or controlling a machine account and manipulating certificate enrollment requests.
By abusing this process, the attacker can convince the certificate authority to issue a valid certificate that identifies them as a legitimate Domain Controller.
The issued certificate can then be used through Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) to authenticate as that Domain Controller.
Potential for Full Domain Compromise
After successfully impersonating a Domain Controller, attackers can perform a DCSync attack to request sensitive directory secrets.
Among the most valuable targets is the krbtgt account, whose credentials are used to generate Kerberos authentication tickets throughout the Active Directory environment.
Compromising the krbtgt account effectively enables attackers to forge authentication tickets and maintain long-term privileged access across the domain.
Exploitation Requirements
Although the attack does not require administrator privileges or user interaction, several conditions must exist for successful exploitation.
Researchers noted that attackers need:
- Network access to the target environment
- A standard Active Directory domain account
- An Enterprise Active Directory Certificate Services deployment
- Certificate enrollment using the default Machine template
- Default machine account creation permissions (MachineAccountQuota)
- Network connectivity between the certificate authority and attacker-controlled SMB and LDAP services
These requirements make the vulnerability particularly concerning for enterprise environments that rely on Active Directory Certificate Services.
Microsoft Releases Security Fix
Microsoft addressed the vulnerability in its July 14, 2026 security updates by strengthening validation checks during certificate enrollment.
The update ensures that certificate authorities verify whether requested systems are genuine Domain Controllers before issuing certificates, preventing attackers from spoofing their identities.
Researchers also identified additional validation mechanisms introduced in the update to detect invalid server names, reject manipulated directory objects, and prevent object substitution attacks.
No Confirmed Active Exploitation
At the time of disclosure, there were no confirmed reports indicating that attackers had exploited the vulnerability in real-world attacks.
However, the availability of a fully functional public exploit significantly increases the risk for organizations that have not yet installed Microsoft’s security updates.
The vulnerability also had not been added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) Catalog at the time of publication.
Temporary Mitigation Available
For organizations unable to immediately apply Microsoft’s security updates, researchers documented a temporary mitigation that disables the vulnerable certificate enrollment behavior.
However, they cautioned that this workaround was only tested in a laboratory environment and may disrupt legitimate certificate enrollment processes. Security teams are advised to validate the mitigation before deploying it in production.
Researchers emphasize that applying Microsoft’s official July security update remains the recommended long-term solution.
Security Recommendations
Organizations using Active Directory Certificate Services should prioritize patching vulnerable systems and review certificate authority configurations for unnecessary exposure.
Security teams should also:
- Install Microsoft’s latest AD CS security updates.
- Audit Enterprise Certificate Authority deployments.
- Monitor certificate enrollment activity for unusual requests.
- Restrict unnecessary machine account creation permissions.
- Review Active Directory logs for suspicious Kerberos authentication events.
With a public exploit now available, cybersecurity experts warn that delaying patch deployment could significantly increase the risk of domain-wide compromise.
