Certighost: Ten Days After the Patch, the Exploit Is Public and…

The Certighost proof-of-concept for CVE-2026-54121 lets a standard domain user impersonate a Domain Controller via AD CS. Released exactly ten days after Microsoft's July 14 patch, the exploit exposes every organization with an unpatched Enterprise CA.

On July 24, 2026, researchers H0j3n and Aniq Fakhrul released the "Certighost" proof-of-concept for CVE-2026-54121, an Active Directory Certificate Services vulnerability rated CVSS 8.8. The code demonstrates how a domain user with minimal privileges — no administrative access, no human interaction required — can obtain a valid certificate as a Domain Controller and from there compromise the entire AD forest in minutes. The publication arrives exactly ten days after Microsoft's patch release on July 14, an interval that exposes every organization with an unpatched AD CS Enterprise CA.

Key Takeaways

CVE-2026-54121 is an improper authorization in AD CS with CVSS 8.8 per Microsoft Corporation as CNA; the patch has been available since July 14, 2026.
The "Certighost" PoC published July 24, 2026 requires only a standard domain account, network access, and the default ms-DS-MachineAccountQuota value of 10 to create a controlled machine account.
The exploit abuses the AD CS "chase" mechanism via the cdc and rmd attributes in the certificate request, redirecting the CA to an attacker-controlled server.
Once the DC certificate is obtained, the attacker performs DCSync to extract the krbtgt secret and forge Golden Tickets with unlimited persistence on the domain.

How the AD CS Chase Becomes a Tunnel to Impersonate the Domain Controller

The "chase" mechanism in AD CS is a fallback during enrollment that allows the Certificate Authority to contact another host to resolve the requester's identity when it cannot do so locally. According to researchers H0j3n and Aniq Fakhrul, the vulnerability lets an attacker supply cdc (the host to contact) and rmd (the principal to resolve) attributes that redirect the CA to a server under their control.

The vulnerable CA followed the host specified in the cdc field over SMB and LDAP "without first verifying it was a legitimate Domain Controller," as the researchers document. On ports 445 and 389, the attacker intercepts the connection and relays the Netlogon authentication to the real Domain Controller, obtaining the target DC's objectSid and dNSHostName. This data is returned to the CA, which embeds it in a signed, valid certificate.

PKINIT authentication with this certificate yields Domain Controller Kerberos credentials, enabling DCSync and extraction of the krbtgt secret for Golden Ticket forgery. The entire chain, from the first packet to domain compromise, requires no elevated privileges: a standard user with ms-DS-MachineAccountQuota set to 10 — the default — can create the machine account needed to authenticate to the CA.

"The vulnerable CA followed the requester-supplied cdc host over SMB and LDAP without first verifying it was a legitimate Domain Controller" — H0j3n and Aniq Fakhrul

The July 14 Patch and What Microsoft Had to Validate

The July update adds the function CRequestInstance::_ValidateChaseTargetIsDC in certpdef.dll, which intercepts the chase path before the CA follows the target. The validation includes three chained checks: DNS resolution, verification that userAccountControl includes the SERVER_TRUST_ACCOUNT flag (value 8192), and SID comparison to block object substitution.

According to the Microsoft advisory of July 14, 2026, the exploitability assessment was "Less Likely" — an evaluation that researchers and security sources implicitly contested with the release of a functional PoC ten days later. The NVD record as of July 14, 2026 indicated exploitation: none in SSVC scoring, confirming that predictive exploitability assessments can become obsolete faster than patch adoption cycles.

The full timeline runs from May 14, 2026 (initial report), through Microsoft confirmation on May 22, the patch on July 14, and exploit disclosure on July 24: roughly two months between confirmation and fix release, ten days between fix and public exploit.

What to Do Now

Apply the July 14, 2026 KB patch on all servers with the AD CS Enterprise CA role, with maximum priority for issuing CAs with EditFlags that include EDITF_ENABLECHASECLIENTDC.
Disable the chase fallback via registry with certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC followed by a CertSvc service restart; the mitigation has been tested in a lab environment by the researchers, not documented in production.
Monitor the domain-level ms-DS-MachineAccountQuota value: if greater than zero, any authenticated user can create machine accounts up to the limit, enabling the exploit prerequisite.
Inspect Netlogon authentication logs and certificate requests with non-standard cdc/rmd attributes to detect relay attempts or anomalous CA targeting of non-DC hosts.

Why "Less Likely" Was No Longer Enough

The Certighost case precisely measures the gap between vendor assessment and threat landscape reality. When Microsoft classified exploitability as "Less Likely" on July 14, the PoC code did not yet exist publicly; ten days later, the technical barrier to compromising an AD domain dropped from "advanced research" to "copy-paste." No source confirms in-the-wild exploitation as of July 24, 2026, but as the researchers themselves note: "the absence of reporting does not prove exploitation has not occurred."

The stakes extend beyond a single CVE. For any organization with AD CS, this vulnerability represents an existential risk: a single user compromised via phishing or initial access becomes, in minutes, a vector for total domain compromise, with persistence via Golden Ticket that survives rotation of standard administrative account passwords. The speed of post-patch disclosure forces security teams into a response tempo that traditional change management processes are not structured to sustain.

Frequently Asked Questions

Is the July 14 patch sufficient, or are further actions needed?

The patch resolves the vulnerability by eliminating the unvalidated chase path. Application is a necessary condition and, per available sources, sufficient to block the documented vector. No variants or bypasses are known at the time of publication.

Why doesn't the exploit require administrative privileges?

Because it exploits two flawed delegation mechanisms: the AD CS chase fallback, which accepts direction from the requester, and the default ms-DS-MachineAccountQuota value of 10, which allows any domain user to create machine accounts. The combination eliminates the need for preliminary escalation.

Is Windows 11 affected?

No. Per the official CVE record, affected systems are Windows Server 2012-2025 (including Server Core) and Windows 10 versions 1607 and 1809. Windows 11 does not appear in the CPE listed by NVD.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references