PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121)

1. Executive summary

A proof-of-concept (PoC) exploit and technical details for CVE-2026-54121 (dubbed "Certighost") were publicly released on July 24, 2026. This is a HIGH severity (CVSS 8.8) improper authorization vulnerability (CWE-285) in Active Directory Certificate Services (AD CS) that allows an authenticated, low-privileged domain user to obtain a certificate impersonating a Domain Controller. The flaw enables full domain compromise via DCSync extraction of the krbtgt secret. Microsoft released patches on July 14, 2026, but exploitation is now highly likely for any unpatched EMEA financial services organization running AD CS.

2. Regulatory framing

3. Technical analysis & attack chain

CVE-2026-54121 is an improper authorization flaw (CWE-285, CVSS 8.8 HIGH) in the AD CS Certification Authority (CA) certificate enrollment process. It is not in CISA KEV and has an EPSS of 1%, though the public PoC publication on July 24, 2026 significantly increases exploitation probability.

Confirmed attack chain

1. Initial position: The attacker possesses a standard domain user account and network access to the target domain.
2. Machine account creation: The attacker creates a machine account using the default ms-DS-MachineAccountQuota setting. This account is a valid domain principal but is controlled by the attacker.
3. Crafted certificate request: The attacker submits a certificate enrollment request to the AD CS CA containing two manipulated attributes: - cdc (Client DC): names the attacker-controlled host the CA should contact. - rmd (Remote Domain): names the principal the CA should look up (e.g., a Domain Controller account).
4. CA "chase" fallback triggered: In cross-domain-controller enrollment scenarios, the CA performs a second directory lookup ("chase"), reaching out to the host specified in cdc via SMB and LDAP connections to fetch identity data for the principal in rmd.
5. Authentication bypass: The attacker-controlled chase host satisfies the CA's authentication checks because the machine account created via ms-DS-MachineAccountQuota is a valid domain principal — even though it is not the Domain Controller being impersonated.
6. Rogue certificate issuance: The CA issues a certificate signed by the CA that authenticates as the target Domain Controller.
7. Kerberos credential theft: The attacker uses the certificate via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos) to obtain Kerberos credentials for the Domain Controller account.
8. DCSync execution: Because Domain Controller accounts hold directory replication rights, the attacker runs DCSync to extract the krbtgt account secret — the master key underpinning Kerberos in the domain.
9. Full domain compromise: With the krbtgt secret, the attacker can forge Golden Tickets and achieve complete domain control.

Key technical details

• Affected component: AD CS Certification Authority (CA) on Windows Server.
• Exploit prerequisites: Authenticated domain user + network access only.
• Vulnerable code path: The cdc chase fallback, an optional feature not invoked on every enrollment request.
• Patch mechanism: Microsoft's July 2026 updates validate the "chase" target before the lookup proceeds.
• Registry mitigation: The vulnerable code path can be disabled via certutil -setreg policy\EditFlags -EDITF_ENABLEC (the full flag name is truncated in the source; verify the complete flag name before execution).

Confidence caveat: The technical mechanism is corroborated across two sources (Help Net Security and The Hacker News). The PoC was published by researchers H0j3n and Aniq Fakhrul. No MITRE ATT&CK actor profile is associated with these researchers; attribution of any subsequent exploitation to named threat actors is unconfirmed at this time.

4. Mitigation & containment

P1 — Within 24 hours

• Apply Microsoft July 2026 updates to all AD CS CA hosts. These patches validate the chase target before the directory lookup proceeds, closing the vulnerable code path. Prioritise Windows Server versions running the CA role.
• Inventory AD CS deployments: Identify all CA servers in the environment and confirm patch status. Many organisations lose visibility of PKI infrastructure due to its low day-to-day operational footprint.

P2 — Within 72 hours

• Disable the chase fallback (if patching is delayed): Run certutil -setreg policy\EditFlags -EDITF_ENABLEC to switch off the cdc chase code path. Note: The source truncates the full flag name — verify the complete registry flag name in Microsoft's documentation before execution. Restart the Certificate Services service after applying.
• Audit machine account creation: Review all machine accounts created via ms-DS-MachineAccountQuota since May 2026 (when the bug was reported). Investigate any accounts created by non-administrative users that cannot be mapped to legitimate workstation joins.
• Hunt for exploitation indicators: Search certificate issuance logs for certificates issued to Domain Controller accounts via PKINIT where the requesting user is not a DC or a trusted computer account. Check for SMB/LDAP connections from CA servers to unexpected internal hosts.

P3 — Within 7 days

• Restrict ms-DS-MachineAccountQuota: Where feasible, set the domain attribute to 0 or a low value to prevent standard users from creating arbitrary machine accounts. This removes a key prerequisite for the attack.
• Review CA certificate issuance policies: Audit which certificate templates allow enrollment by broad user groups and restrict to least privilege.
• Validate DCSync exposure: Confirm that only Domain Admins and explicitly delegated accounts have directory replication permissions. Use tools such as AdFind or BloodHound to identify unexpected replication paths.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file names) are available in the source material.

Behavioural indicators

6. Detection

rule AD_CS_Certighost_Enrollment_Abuse {
  meta:
    author = "Adverse Trace"
    date = "2026-07-27"
    reference = "https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html"
    description = "Detects Certighost CVE-2026-54121 exploit artefacts referencing cdc/rmd chase attributes"
  strings:
    $cdc = "cdc" ascii
    $rmd = "rmd" ascii
    $editf = "EDITF_ENABLEC" ascii
    $certutil_setreg = "certutil -setreg policy\\EditFlags" ascii
  condition:
    3 of them
}

title: AD CS Certificate Enrollment to Non-DC Host via CDC Chase
id: 7a3c1f2e-2026-4b8d-9e1a-cve202654121
status: experimental
description: >
  Detects SMB or LDAP connections from an AD CS Certification Authority server
  to a non-Domain-Controller host during certificate enrollment, consistent with
  CVE-2026-54121 (Certighost) chase behaviour.
author: Adverse Trace
date: 2026/07/27
references:

  - https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html
  - https://www.helpnetsecurity.com/2026/07/27/certighost-cve-2026-54121-poc-exploit-released/
logsource:
  product: windows
  service: security
detection:
  selection_smb:
    EventID: 5140
    SubjectUserName|contains:

      - "CertSvc"
      - "SYSTEM"
  filter_legitimate:
    ShareName|contains:

      - "SYSVOL"
      - "NETLOGON"
  condition: selection_smb and not filter_legitimate
falsepositives:

  - Legitimate cross-domain enrollment scenarios
  - CA server accessing non-DC file shares for operational reasons
level: high

title: PKINIT Authentication as Domain Controller from Non-DC Host
id: 8b4d2e3f-2026-5c9e-af2b-cve202654121
status: experimental
description: >
  Detects Kerberos PKINIT authentication using a certificate that authenticates
  as a Domain Controller account, originating from a host that is not a Domain
  Controller. Consistent with CVE-2026-54121 (Certighost) exploitation.
author: Adverse Trace
date: 2026/07/27
references:

  - https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html
logsource:
  product: windows
  service: security
detection:
  selection_ticket:
    EventID: 4768
    TicketEncryptionType: 0x12
  filter_dc:
    HostName|endswith: "$"
    SubjectUserName|endswith: "$"
  condition: selection_ticket and not filter_dc
falsepositives:

  - Legitimate DC certificate renewal from a DC host not in the DC OU
level: critical

CVE assessment

1 referenced CVE

7. Sources

• Help Net Security — "PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121)" — https://www.helpnetsecurity.com/2026/07/27/certighost-cve-2026-54121-poc-exploit-released/ — 2026-07-27
• The Hacker News — "Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller" — https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html — 2026-07-24

8. Adverse Trace position

CVE-2026-54121 is a HIGH severity (CVSS 8.8) flaw with a direct path to full domain compromise from a standard user account — the attack chain is low-complexity, requires no special tooling beyond the published PoC, and targets identity infrastructure that EMEA financial services organisations depend on for authentication, encryption, and signing. Although the vulnerability is not currently in CISA KEV (EPSS 1%), the July 24 public PoC release invalidates Microsoft's original "less likely" exploitation assessment. Any unpatched AD CS deployment with default ms-DS-MachineAccountQuota settings is exposed. Clients should treat patching of CA hosts as an immediate P1 action and implement the registry-based chase fallback mitigation where patching cannot be completed within 24 hours. We will monitor for evidence of active exploitation and update this advisory if CISA KEV status changes or named actor attribution emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.