Full research report
New Certighost PoC exploit lets attackers hijack Windows domains
Executive assessment
Certighost exploits a design gap in the AD CS certificate enrollment chase mechanism: the CA historically accepted requester-supplied host pointers for identity resolution without verifying the target was a legitimate domain controller, an assumption that was safe in intended cross-domain scenarios but becomes a privilege escalation path when exposed to adversarial inputs. The attack's severity is compounded by its low entry bar — any domain user with default account creation rights can stage it without administrator interaction or victim action. Microsoft's patch is surgical, adding three layers of host and identity validation to the chase path; the certutil workaround is functional but fragile against Group Policy reapplication, making the patch the only durable remediation. The ten-day gap between patch and PoC publication is relatively short, and the exploit's automation leaves little skill requirement for would-be attackers. No threat actor adoption had been documented by 27 July 2026, but the combination of a working public PoC, a low privilege bar, and a domain-takeover impact profile makes this an attractive target for ransomware operators and state-sponsored actors already present in corporate AD environments.
What happened
Security researchers H0j3n (Muhammad Ali) and Aniq Fakhrul discovered a flaw in the Active Directory Certificate Services certificate enrollment fallback mechanism, reported it to Microsoft on 14 May 2026, and Microsoft patched it on 14 July 2026 as CVE-2026-54121. On 24 July 2026, the researchers publicly released full technical details alongside a working Python proof-of-concept named Certighost. Coverage by BleepingComputer, Help Net Security, and The Hacker News followed on 27 July 2026.
Affected scope
Active Directory Certificate Services on Windows Server 2012 through Windows Server 2025 (including Server Core editions) and Windows 10 versions 1607 and 1809; any environment where an Enterprise CA is reachable by domain users and the chase fallback is enabled, which is the default configuration.
Technical assessment
The AD CS certificate enrollment process includes a fallback 'chase' mechanism in which the CA contacts a remote server — identified by attacker-controllable `cdc` (Client DC) and `rmd` (Remote Domain) request attributes — to resolve directory identity for the certificate subject. Prior to the patch, the CA did not validate that the `cdc` target was a legitimate domain controller. A low-privileged attacker with the default right to create machine accounts (ms-DS-MachineAccountQuota defaults to 10) could direct the CA to attacker-controlled SMB and LDAP services. The CA accepted the false identity returned and issued a certificate authenticating as the targeted domain controller. That certificate enables PKINIT-based Kerberos authentication as the DC, granting directory replication rights and enabling DCSync extraction of the krbtgt account secret — constituting complete domain and potential forest compromise. The July 2026 patch adds three controls: validation that the `cdc` hostname maps to an AD object bearing the SERVER_TRUST_ACCOUNT flag, input sanitisation rejecting oversized names, IP addresses, and LDAP injection characters, and SID comparison to prevent object substitution.
Recommended defensive actions
- Apply the July 14 2026 Patch Tuesday update to all Windows Server systems running Active Directory Certificate Services — this is the primary and recommended remediation.
- Disable the chase fallback immediately if patching cannot be completed within hours, using `certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC` on each CA then restarting the Certificate Services service; note this workaround can be silently overridden by Group Policy reapplication.
- Audit Active Directory for recently created machine accounts in the default Computers container to identify potential attacker staging activity predating patch deployment.
- Monitor CA audit logs for Event IDs 4886 (certificate requested) and 4887 (certificate issued) containing non-standard extension attributes, and for Event ID 4662 with directory replication rights indicating a DCSync attempt.
- Review and restrict ms-DS-MachineAccountQuota below its default of 10 to reduce the pool of accounts able to stage this attack without elevated privileges.
Uncertainties and evidence gaps
- The MSRC advisory page uses dynamic rendering and could not be machine-read; CVSS 8.8 and the Exploitation Less Likely rating are sourced from Rapid7 and Help Net Security rather than directly from the official advisory.
- The precise set of Windows Server patch KB numbers and full version applicability has not been independently verified against the complete MSRC advisory content.
- No threat actor adoption of the PoC had been documented as of 27 July 2026; whether exploitation materialises in practice following the public PoC release remains to be observed.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Public PoC (certighost.py) released 24 July 2026, ten days after the patch; no confirmed active exploitation in the wild as of 27 July 2026; Microsoft's initial exploitation assessment at patch release was 'Exploitation Less Likely'.
Investigation began with the BleepingComputer article describing a new PoC exploit for an AD CS flaw named Certighost. Primary source verification confirmed the PoC's existence on GitHub and the technical writeup in the researcher's gist, established the patch and disclosure timeline through multiple independent outlets, and found no evidence of active threat actor exploitation as of 27 July 2026. The key evidentiary gap is that the MSRC advisory page uses dynamic rendering and could not be machine-read, so the official CVSS and exploitation rating are corroborated via Rapid7 and Help Net Security rather than directly from Microsoft.
- Does the BleepingComputer article accurately describe the vulnerability and can its claims be confirmed?Fetched the BleepingComputer article to extract all factual claims including CVE, mechanism, timeline, and researcher attribution.bleepingcomputer.com ↗
Article confirmed CVE-2026-54121, the chase mechanism abuse via cdc/rmd attributes, PKINIT-based DC impersonation, DCSync impact, researchers H0j3n and Aniq Fakhrul, May 14 report date, July 14 patch date, and July 24 PoC release date.
why Established a working fact base consistent with a credible disclosure; warranted independent verification of all key claims.
- What independent sources cover CVE-2026-54121 and does a public PoC actually exist on GitHub?Searched for CVE-2026-54121 Certighost across security news and code-hosting platforms.
Multiple independent outlets corroborate the story (Help Net Security, The Hacker News, Rapid7, Field Effect). The GitHub repository aniqfakhrul/CVE-2026-54121 and the researcher's technical gist were both identified as primary sources.
why Confirmed the story is independently covered and the PoC is genuinely publicly available, establishing high base confidence and elevated urgency for unpatched environments.
- What does the original researcher technical writeup say about the mechanism and the patch?Fetched the H0j3n GitHub Gist containing the full technical disclosure.gist.github.com ↗
The gist provides full technical detail including the three controls introduced by the July patch (target validation, input sanitisation, SID comparison), the temporary certutil workaround, and confirms the July 24 2026 public disclosure date.
why Highest-fidelity technical source as it comes directly from the discovering researchers; confirms the patch architecture and the pre-patch design gap.
- Does the PoC repository exist and what does the exploit actually do?Fetched the GitHub repository aniqfakhrul/CVE-2026-54121.github.com ↗
Repository confirmed present; certighost.py automates machine account creation, rogue SMB and LDAP listener setup, certificate request attribute injection, PKINIT-based credential extraction, and NT hash retrieval. Requires low-privileged domain credentials.
why Confirms the PoC is real, functional, and publicly accessible — not merely claimed. Materially increases exploitation risk for unpatched environments with no additional skill requirement.
- What is the official Microsoft CVSS score and exploitation assessment?Fetched the MSRC advisory page for CVE-2026-54121.msrc.microsoft.com ↗
Page loaded but returned only a page title due to dynamic JavaScript rendering; no machine-readable advisory data was available.
why Cannot directly cite MSRC data; independent corroboration required for CVSS score and exploitation assessment.
- Can independent professional sources confirm the CVSS score and Microsoft's exploitation assessment?Fetched Rapid7 Patch Tuesday July 2026 analysis and Help Net Security article.rapid7.com ↗
Rapid7 confirms CVSS 8.8 and Exploitation Less Likely at patch release. Help Net Security independently confirms CVSS 8.8, no in-the-wild exploitation as of July 27 2026, and reproduces the certutil mitigation command.
why Two independent professional sources compensate for the inaccessible MSRC page and together provide sufficient corroboration of severity and exploitation status.
- Do additional sources add detail on affected Windows versions and whether threat actors have adopted the PoC?Fetched The Hacker News article on Certighost.thehackernews.com ↗
Confirms affected versions as Windows Server 2012–2025 and Windows 10 1607/1809; Microsoft explicitly states it observed researcher testing activity tied to the flaw but has not confirmed active exploitation by threat actors as of July 27 2026.
why Adds affected version specificity and the Microsoft attribution-to-researchers-only statement, strengthening the no-active-exploitation finding with an attributed Microsoft quote.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok8 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| Rapid7news | ok empty0 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1655 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5307 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok666 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shodanresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 5 opened outside the registered collection
Reporting-linked PoC claims2
Linked by reporting but not validated as PoC by the configured exploit indexes.
Linked by reporting but not validated as PoC by the configured exploit indexes.
PoC & exploit code2
Working Python PoC automating machine account creation, rogue SMB/LDAP listener setup, certificate request injection, PKINIT credential extraction, and DCSync via Impacket.
Original researcher writeup detailing the chase mechanism, exploit steps, and the three validation controls introduced by the July patch.
Vendor & gov advisories3
Canonical Microsoft advisory; page is dynamically rendered and full content could not be machine-read, but independently corroborated as CVSS 8.8 and Exploitation Less Likely via Rapid7 and Help Net Security.
Independently confirms CVSS 8.8 and Microsoft's Exploitation Less Likely rating for CVE-2026-54121 at the July 14 2026 patch release.
Corroborates patch date, CVSS score, no in-the-wild exploitation, and the temporary certutil mitigation command.
Analysis & research2
Confirms affected versions (Windows Server 2012–2025, Windows 10 1607/1809) and Microsoft's statement that observed activity is limited to researcher testing with no confirmed threat actor exploitation.
Primary news source providing detailed description of the chase mechanism, DCSync attack chain, and researcher disclosure timeline.