A proof-of-concept exploit dubbed “Certighost” has been publicly released for CVE-2026-54121, an Active Directory Certificate Services (AD CS) vulnerability that Microsoft patched during the July 2026 Patch Tuesday updates. The flaw allows an authenticated, low-privileged attacker to obtain a certificate that lets them authenticate as a domain controller via PKINIT, potentially leading to full domain compromise.
Researchers H0j3n and Aniq Fakhrul reported the issue to Microsoft on May 14, 2026, and publicly disclosed technical details and an exploit tool last week following the July fix.
How the Attack Works
The vulnerability abuses a fallback mechanism in AD CS certificate enrollment referred to as a “chase.” During enrollment, two attacker-supplied values, cdc (Client DC) and rmd (Remote Domain), tell the Certification Authority which server to contact and which account to search for. Prior to the patch, the CA did not verify that the server specified in the cdc value was a legitimate domain controller.
This allowed an attacker to stand up rogue SMB, LSA, and LDAP services and direct the CA to that attacker-controlled system, which could then return false identity information for a targeted machine account, including a domain controller account.
In the demonstrated attack, a low-privileged user first creates a machine account, which is permitted by default under the ms-DS-MachineAccountQuota setting. This account satisfies the CA’s authentication checks even though it is not the domain controller being impersonated. The attacker then submits a certificate request pointing the CA at the rogue chase endpoint while targeting a domain controller account. Because the CA trusts the returned identity data, it issues a certificate usable to authenticate as that domain controller.
The released certighost.py tool automates this process, authenticating via PKINIT, saving Kerberos credentials to a .ccache file, and extracting the account’s NT hash. The researchers then used Impacket’s secretsdump to perform a DCSync attack and retrieve the krbtgt account’s credentials, since domain controller accounts hold directory replication rights.
Mitigation
Microsoft’s July fix adds validation to the chase process, confirming that the cdc value maps to a legitimate domain controller and that the returned identity matches the expected account.
For organizations that cannot immediately apply the update, the researchers note that admins can disable the optional chase fallback using:
- certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
- Restart-Service CertSvc -Force
This workaround is described as untested in production and only a temporary measure. Admins should prioritize deploying the July 2026 security updates as soon as possible.