Full research report
Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
Executive assessment
Certighost is a well-evidenced, high-severity privilege escalation in AD CS whose entire kill chain—from domain user to krbtgt extraction—is automated in a publicly available Python tool. The technical root cause (unauthenticated trust of requester-supplied directory attributes during certificate enrolment) follows a pattern established by ESC-class AD CS research, but unlike prior ESC misconfigurations this flaw is in Microsoft's own CA code rather than administrator configuration choices, meaning it affected every default Enterprise CA deployment. Microsoft's patch is structurally sound: it gates the chase on Active Directory-backed DC verification and SID validation rather than merely sanitising input strings. The ten-day window between patch and public PoC release was narrow; organisations that applied Patch Tuesday promptly are protected, but the automated exploit lowers the barrier for threat actors targeting unpatched environments. Near-term wild exploitation is a realistic risk given the high-value outcome and low entry bar.
What happened
Security researchers H0j3n and Aniq Fakhrul disclosed CVE-2026-54121 (branded Certighost) on 24 July 2026, simultaneously releasing a working Python exploit. The vulnerability is an improper authorisation flaw (CWE-285) in Active Directory Certificate Services allowing any low-privileged domain user to obtain a certificate bearing a Domain Controller's identity and then extract the domain's krbtgt secret via DCSync. The flaw was reported to Microsoft on 14 May 2026, confirmed on 22 May, and patched ten days before public disclosure on 14 July 2026.
Affected scope
All Windows Server versions (2012 through 2025, including Server Core editions) and Windows 10 versions 1607 and 1809 where the AD CS Enterprise CA role is installed with the default Machine certificate template. Any organisation running an Enterprise CA that has not applied the July 2026 Patch Tuesday updates and permits domain users to create computer accounts is affected.
Technical assessment
The flaw resides in the 'chase' fallback of the AD CS certificate enrolment protocol in certpdef.dll. The Certificate Authority accepted two requester-supplied attributes—cdc (client domain controller host) and rmd (remote machine object)—to locate a domain controller for identity resolution, without first confirming the nominated host was a legitimate DC. An attacker running rogue SMB (port 445) and LDAP (port 389) listeners could relay the CA's authentication challenge to the real Domain Controller over Netlogon, return the target DC's objectSid and dNSHostName, and cause the CA to embed the DC's identity in the issued certificate. PKINIT authentication with that certificate grants Kerberos credentials carrying directory replication rights, enabling DCSync. Microsoft's July patch adds CRequestInstance::_ValidateChaseTargetIsDC in certpdef.dll, enforcing hostname syntax checks, requiring the target to appear in AD as a SERVER_TRUST_ACCOUNT computer object, and validating the resolved SID to block object substitution.
Recommended defensive actions
- Apply Microsoft's July 2026 Patch Tuesday updates to all hosts running the AD CS role as the permanent fix.
- If immediate patching is not possible, disable the chase fallback on the CA host: run 'certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC' followed by 'Restart-Service CertSvc -Force' — stage this in a test environment first as it may disrupt legitimate enrolment flows.
- Audit AD CS enrolment logs for certificate requests containing unexpected cdc or rmd attributes; alert on certificates issued bearing SERVER_TRUST_ACCOUNT computer identities from non-DC requesters.
- Review ms-DS-MachineAccountQuota and consider setting it to 0 where operational requirements permit, to remove the attacker's ability to create the computer account required for the attack chain.
Uncertainties and evidence gaps
- Wild exploitation cannot be ruled out; the absence of confirmed exploitation as of 24 July reflects the same-day nature of the PoC release, and threat actor adoption of automated exploit code can occur within hours.
- CISA KEV catalogue status could not be independently verified (HTTP 403 on direct fetch); the 'not listed' claim rests solely on the THN article.
- The SentinelOne record stated 'no verified public exploit is available' — this conflicts with the confirmed GitHub PoC and is assessed as a record last updated before 24 July rather than a genuine factual dispute, but the discrepancy cannot be fully resolved without knowing SentinelOne's record timestamp.
- The Microsoft MSRC advisory page requires JavaScript rendering and specific KB article numbers per affected Windows version could not be retrieved from this investigation.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Public working Python exploit released 24 July 2026; no confirmed wild exploitation as of that date; absent from CISA KEV per THN reporting (direct CISA fetch returned HTTP 403)
The investigation began with the THN article as untrusted input and sought primary-source verification of the timeline, technical mechanism, and exploitation status. The researchers' own GitHub PoC and technical gist were fetched and confirmed as the authoritative primary sources. The NVD record and CyberSecurityNews provided independent corroboration of scope and severity. A minor discrepancy in the SentinelOne database ('no public exploit') was resolved as a stale record predating the 24 July PoC release rather than a factual contradiction. All core claims across sources are consistent, supporting a high-confidence assessment.
- Does the source article exist and what does it claim?Fetched the THN article to verify publication and extract factual claimsthehackernews.com ↗
Article confirmed. Key claims: CVE-2026-54121, CVSS 8.8, researchers H0j3n and Aniq Fakhrul, patched 14 July, full PoC released 24 July, no confirmed wild exploitation, certutil interim mitigation documented
why Establishes the baseline narrative and the specific claims requiring independent verification
- Is a public PoC confirmed and what does it do?Fetched the aniqfakhrul GitHub PoC repositorygithub.com ↗
Repository confirmed with 107 stars and 25 forks; Python script automates computer account creation, rogue SMB/LDAP listener setup, cdc/rmd attribute injection, Netlogon relay, certificate retrieval, and PKINIT authentication to produce a .pfx and .ccache
why Confirms the PoC is public, functional, and lowers the skill barrier for exploitation; increases urgency of the patching assessment
- What do the primary researchers' own disclosures state?Fetched H0j3n's GitHub Gist technical write-upgist.github.com ↗
Confirms the chase mechanism (cdc/rmd attributes), binary analysis of Microsoft's patch (CRequestInstance::_ValidateChaseTargetIsDC in certpdef.dll, SERVER_TRUST_ACCOUNT validation, SID comparison), and the complete disclosure timeline (reported 14 May, confirmed 22 May, patched 14 July, disclosed 24 July)
why Highest-confidence technical source; directly authored by a discoverer and provides patch-level analysis confirming the fix is structural
- What does NVD independently confirm about scope and severity?Fetched NVD entry for CVE-2026-54121nvd.nist.gov ↗
CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-285, affected products confirmed as Windows Server 2012 through 2025 and Windows 10 1607/1809; published 14 July, last modified 21 July; exploitation status listed as none documented
why Authoritative independent record; last-modified date of 21 July predates the 24 July PoC release, explaining why exploitation status shows none documented
- Is there independent secondary reporting corroborating the technical claims?Fetched CyberSecurityNews article on Certighostcybersecuritynews.com ↗
Independently corroborates cdc/rmd abuse vector, Netlogon relay mechanism, DCSync impact, and certutil mitigation; adds no contradictory claims
why Provides the required second independent domain confirming the core technical narrative
- Does the SentinelOne database record raise any contradictions?Fetched SentinelOne vulnerability database entry for CVE-2026-54121sentinelone.com ↗
States 'no verified public exploit is available' and EPSS 0.80%; conflicts with the confirmed GitHub PoC; assessed as a stale record last updated before 24 July
why Discrepancy is resolved in favour of the GitHub evidence; the SentinelOne record timing explains the apparent contradiction and does not undermine the assessment
- Is CVE-2026-54121 listed in the CISA Known Exploited Vulnerabilities catalogue?Attempted direct fetch of CISA KEV catalogue
HTTP 403 Forbidden; page inaccessible. THN article states the CVE was absent from KEV as of 24 July; this cannot be independently verified in this investigation
why Inability to confirm is noted as a material uncertainty; the THN claim is consistent with all other sources showing no confirmed wild exploitation
Research coverage
All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 2 corroborating, 0 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok10 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| CISA KEVkev | ok1653 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok9 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5307 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok662 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok7016 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1583 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Reporting-linked PoC claims1
Linked by reporting but not validated as PoC by the configured exploit indexes.
PoC & exploit code2
Full Python exploit automating the Certighost chain; 107 stars, 25 forks as of 24 July 2026
Primary researcher's write-up covering the chase mechanism, patch binary analysis, and full attack chain
Vendor & gov advisories2
Official Microsoft advisory; page requires JavaScript rendering so full KB details could not be retrieved
Confirms CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-285, and affected Windows Server 2012–2025 plus Windows 10 1607/1809
Analysis & research2
Independent secondary coverage corroborating the cdc/rmd abuse vector, relay mechanism, DCSync impact, and interim mitigation
Third-party database entry; 'no verified public exploit' claim is outdated, predating the 24 July PoC release