New Certighost PoC exploit lets attackers hijack Windows domains

1. Executive summary

A working proof-of-concept (PoC) exploit for CVE-2026-54121, dubbed "Certighost," has been publicly released, demonstrating how a low-privileged authenticated Active Directory (AD) user can escalate privileges to achieve full domain compromise. The vulnerability resides in the Active Directory Certificate Services (AD CS) "chase" fallback mechanism, which fails to validate that a server specified in a certificate enrollment request is a legitimate domain controller. Microsoft patched the flaw in the July 2026 Patch Tuesday; however, the public availability of the certighost.py exploit script lowers the barrier to entry for domain takeover in unpatched EMEA financial services environments.

2. Regulatory framing

3. Technical analysis & attack chain

CVE-2026-54121 is a privilege elevation vulnerability in Microsoft Active Directory Certificate Services (AD CS), the Windows Server role responsible for PKI operations. No verified CVSS score, severity rating, or CISA-KEV exploitation state was resolved for this item in the supplied reference data; the source material describes it as "critical" but this assessment is single-sourced and unverified. The vulnerability was reported to Microsoft by researchers H0j3n and Aniq Fakhrul on May 14, 2026, and patched in the July 2026 Patch Tuesday.

Attack chain (confirmed from source material)

1. Initial position: The attacker holds a low-privileged AD domain user account. Under the default ms-DS-MachineAccountQuota configuration, any domain user can create a machine account, which is a valid domain principal.
2. Rogue service deployment: The attacker stands up rogue SMB, LSA, and LDAP services on an attacker-controlled system.
3. Certificate request manipulation: The attacker submits a certificate enrollment request to the CA containing two attacker-controlled values: - cdc (Client DC): identifies the server the CA should contact — set to the attacker's rogue system. - rmd (Remote Domain): identifies the account the CA should search for — set to a target Domain Controller account.
4. Chase mechanism abuse: The AD CS "chase" fallback mechanism connects to the server specified in cdc and searches for the account in rmd. The system does not verify that the cdc-specified server is a legitimate domain controller. The attacker-controlled machine account satisfies the authentication checks, and the rogue services return false directory information for the targeted DC account.
5. Certificate issuance: The CA, trusting the identity information returned by the attacker-controlled services, issues a certificate that can be used to authenticate as the targeted Domain Controller.
6. PKINIT authentication: The released certighost.py PoC automates authentication via PKINIT as the targeted Domain Controller, saving the resulting Kerberos credentials to a .ccache file and extracting the account's NT hash.
7. DCSync and full compromise: Using the saved Kerberos credentials with Impacket's secretsdump tool, the attacker performs a DCSync attack. Because the Domain Controller account has directory replication rights, the attacker retrieves the krbtgt account's credentials, achieving complete domain compromise.

Key technical details

• Affected component: AD CS certificate enrollment "chase" mechanism.
• Exploit script: certighost.py (publicly released July 24, 2026).
• Post-exploitation tooling: Impacket secretsdump for DCSync.
• Credential artefacts: .ccache file (Kerberos), NT hash extraction.
• Prerequisites: Authenticated low-privileged domain user; default ms-DS-MachineAccountQuota setting; AD CS deployed in the affected configuration.
• Patch: Microsoft July 2026 Patch Tuesday security updates.

Confidence caveat: The full technical mechanism, exploit chain, and tool names are corroborated across three independent sources (BleepingComputer, Help Net Security, The Hacker News). The "critical" severity rating is single-sourced (Help Net Security) and could not be verified against NVD or CISA-KEV data in the supplied reference set.

4. Mitigation & containment

P1 — Within 24 hours

• Apply the Microsoft July 2026 Patch Tuesday security updates to all Windows Server hosts running the AD CS role. This is the primary remediation.
• Identify all Certificate Authority servers in the environment and confirm patch status. Query with PowerShell: powershell Get-ADObject -Filter * -SearchBase "CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=<domain>,DC=<tld>"
• Audit for anomalous machine account creation by non-administrative users. Review Event ID 4741 (computer account created) for accounts created by standard user SIDs.

P2 — Within 72 hours

• Restrict ms-DS-MachineAccountQuota to 0 for standard users where machine account self-service is not required, eliminating the prerequisite for the attack: powershell Set-ADDomain -Identity <domain> -Replace @{"ms-DS-MachineAccountQuota"="0"} Note: Assess impact on legitimate machine join workflows before applying.
• Deploy EDR detection rules for rogue SMB/LSA/LDAP service creation on non-DC hosts (see §6).
• Review AD CS certificate issuance logs for certificates issued to Domain Controller accounts where the requesting user is not a DC or admin. Check CA Event ID 4886 (Certificate Services received certificate request) and 4887 (Certificate Services approved certificate request).

P3 — Within 7 days

• Audit all recently issued certificates to Domain Controller machine accounts. Revoke any certificates that cannot be attributed to legitimate DC enrollment activity.
• Validate that PKINIT authentication events for Domain Controller accounts originate from legitimate DC IP addresses only. Monitor for PKINIT TGS requests from non-DC systems.
• Review and restrict Certificate Authority permissions to limit which templates allow machine account enrollment, reducing the attack surface for certificate-based impersonation.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file paths beyond the exploit script name) are available in the source material. The sources describe observable behaviours that indicate exploitation.

Behavioural indicators

6. Detection

rule Certighost_Exploit_Script {
  meta:
    author = "Adverse Trace"
    date = "2026-07-28"
    reference = "https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/"
    description = "Detects the Certighost PoC exploit script by characteristic strings"
  strings:
    $script_name = "certighost.py" nocase
    $cdc = "cdc" ascii
    $rmd = "rmd" ascii
    $pkinit = "PKINIT" ascii nocase
    $ccache = ".ccache" ascii nocase
    $secretsdump = "secretsdump" ascii nocase
    $krbtgt = "krbtgt" ascii nocase
    $machine_quota = "ms-DS-MachineAccountQuota" ascii nocase
  condition:
    $script_name and ($cdc and $rmd) and ($pkinit or $ccache) and ($secretsdump or $krbtgt) and $machine_quota
}

title: Certighost - Machine Account Creation Followed by DC Certificate Enrollment
id: 7a3c1e92-5b4f-4d8a-9e6c-3f2a1b0d8c7e
status: experimental
description: Detects a low-privileged user creating a machine account followed by a certificate enrollment request targeting a Domain Controller account, consistent with CVE-2026-54121 (Certighost) exploitation.
references:

  - https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/
  - https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html
author: Adverse Trace
date: 2026/07/28
tags:

  - attack.credential_access
  - attack.privilege_escalation
  - attack.t1552
  - attack.t1606
logsource:
  product: windows
  service: security
detection:
  selection_machine_creation:
    EventID: 4741
  filter_admin_creator:
    SubjectUserName|contains:

      - "admin"
      - "$"
  condition: selection_machine_creation and not filter_admin_creator
  timeframe: 1h
falsepositives:

  - Legitimate non-admin machine account joins (assess organisational baseline)
  - Automated provisioning systems using service accounts
level: high

title: Certighost - DCSync from Non-DC Principal
id: 8b4d2f03-6c5a-4e9b-af7d-4a3b2c1e9d8f
status: experimental
description: Detects DCSync replication requests (DS-Replication-Get-Changes) originating from a principal that is not a Domain Controller, consistent with post-Certighost credential extraction.
references:

  - https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html
author: Adverse Trace
date: 2026/07/28
tags:

  - attack.credential_access
  - attack.t1003.006
logsource:
  product: windows
  service: security
detection:
  selection_replication:
    EventID: 4662
    Properties|contains:

      - "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
      - "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
  filter_dc_account:
    SubjectUserName|endswith: "$"
    SubjectUserName|startswith:

      - "DC01"
      - "DC02"
      - "DC03"
  condition: selection_replication and not filter_dc_account
falsepositives:

  - Legitimate AD Connect or backup service accounts with replication rights (should be explicitly allowlisted)
level: critical

7. Sources

• BleepingComputer — "New Certighost PoC exploit lets attackers hijack Windows domains" — https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/ — 2026-07-27
• Help Net Security — "PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121)" — https://www.helpnetsecurity.com/2026/07/27/certighost-cve-2026-54121-poc-exploit-released/ — 2026-07-27
• The Hacker News — "Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller" — https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html — 2026-07-27

8. Adverse Trace position

CVE-2026-54121 (Certighost) represents a high-impact privilege escalation path for any EMEA financial services organisation running AD CS in the affected configuration. The attack requires only a standard domain user credential and the default machine account quota — conditions present in most enterprise AD environments. With a working public PoC (certighost.py) now available, the window between patch availability and active exploitation is narrowing. Clients should treat July 2026 Patch Tuesday deployment on all AD CS hosts as the highest-priority remediation action this cycle, supplemented by restricting ms-DS-MachineAccountQuota and deploying the behavioural detections in §6. We are unable to confirm a CVSS score, NVD severity rating, or CISA-KEV exploitation state from the supplied reference data; the "critical" characterisation is single-sourced and should be verified against NVD before inclusion in formal risk registers. We will monitor for KEV addition and active exploitation reporting and update this advisory if the threat landscape changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.