Security Intelligence
Loading table of contents...
Loading table of contents...
At a glance:
-
A public proof-of-concept exploit, dubbed Certighost, shows how an attacker with a standard Active Directory domain account can abuse Active Directory Certificate Services (AD CS) to impersonate a Domain Controller and access highly sensitive Active Directory secrets and credentials.
-
Microsoft released security updates on July 14, 2026, and researchers publicly disclosed the exploit on July 24, providing organizations and threat actors with a documented method to assess or abuse vulnerable AD CS deployments.
-
There is currently no public evidence of active exploitation, but organizations using AD CS should prioritize applying Microsoft's updates and reviewing certificate-related configurations now that a functional public exploit is available.
Threat summary
On July 24, 2026, researchers published a proof-of-concept (PoC) exploit named Certighost for a privilege escalation vulnerability in Microsoft Active Directory Certificate Services (AD CS). The exploit demonstrates how a low-privileged Active Directory (AD) user can obtain a certificate for a Domain Controller (DC) and authenticate as that DC.
AD CS is Microsoft's public key infrastructure (PKI) service for issuing and managing digital certificates in Windows environments. Organizations commonly use AD CS for device and user authentication, smart card deployments, wireless network authentication, and other certificate-based security services.
The flaw, tracked as CVE-2026-54121, affects an AD CS enrollment process known as "chase" functionality. Researchers found that a Certification Authority (CA) could follow requester-supplied directory information during the AD CS chase process without adequately validating that the specified destination was a legitimate Domain Controller. By abusing this behavior, an adversary can influence the certificate enrollment process and obtain a certificate for a target DC identity.
Exploitation requires network access, a valid domain account, and an Enterprise CA configured in a vulnerable enrollment path. Administrator privileges and user interaction are not required. In the researchers' testing, a standard Domain Users account successfully exploited the vulnerability using default AD settings, including the default MachineAccountQuota configuration that allows users to create machine accounts.
Once a DC certificate is obtained, the adversary can use Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) to authenticate as the Domain Controller. Researchers demonstrated that this access can then be used to perform DCSync operations and retrieve sensitive Active Directory secrets, including the krbtgt account credential. Access to the krbtgt account can enable domain-wide persistence and effectively lead to complete Active Directory compromise.
Microsoft released patches for CVE-2026-54121 on July 14, 2026, and assigned the vulnerability a Common Vulnerability Scoring System (CVSS) score of 8.8 and high-severity rating.
As of July 24, 2026, public reporting had not identified active exploitation in the wild. However, a fully functional public PoC is now available, which lowers the effort required to reproduce the attack in vulnerable environments.
Recommendations
The exploit targets AD CS, a core identity infrastructure component responsible for issuing trusted digital certificates across the domain. By abusing AD CS, a threat actor can obtain a certificate that identifies them as a Domain Controller, allowing other systems and services in the environment to recognize and trust that identity as legitimate.
While there is no public evidence that CVE-2026-54121 has been exploited in the wild, the exploit automates the attack chain and demonstrates a path from a standard domain account to Domain Controller-level privileges in affected environments.
Researchers demonstrated that an adversary can obtain DC authentication privileges and perform DCSync operations to access Active Directory secrets, including the krbtgt account credential. Access to the krbtgt account can enable long-term persistence and provide a path to complete Active Directory compromise.
Organizations running AD CS are advised to apply Microsoft's July 14, 2026 security updates for CVE-2026-54121 on affected Certification Authorities (CAs). The update addresses the flaw that allows a Certification Authority to issue a Domain Controller certificate based on manipulated enrollment information, preventing adversaries from obtaining certificates that can be used to impersonate a Domain Controller.
Organizations are also advised to review Enterprise CA deployments, certificate enrollment permissions, machine account creation settings, and certificate templates exposed to standard domain users.
Monitoring for unusual machine account creation, certificate enrollment activity, and DCSync operations can help identify attempts to abuse AD CS for privilege escalation.
Where patch deployment requires additional planning, researchers documented a workaround that disables the vulnerable chase functionality, although testing is recommended because the change can affect legitimate certificate enrollment workflows.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
.jpg)