A working exploit for Certighost (CVE-2026-54121) landed on GitHub on July 24. Any authenticated domain user — no admin rights, no elevated permissions — can now impersonate a Domain Controller, DCSync the krbtgt master key, and forge Golden Tickets for persistent, undetectable access to your entire Active Directory. Microsoft patched this on July 14. If your AD CS servers have not seen that update, you are fully exposed right now.
What Certighost Actually Is
Active Directory Certificate Services has an enrollment fallback called a “chase” — a secondary directory lookup triggered when the CA cannot resolve an end entity during cross-domain enrollment. The mechanism lets certificate requests specify two attributes: cdc (which host the CA should contact) and rmd (which principal to resolve). Microsoft’s CA trusted these attributes without verifying the supplied host was a legitimate Domain Controller.
Researchers H0j3n and Aniq Fakhrul realized this was exploitable: stand up rogue SMB and LDAP listeners on any machine in the domain, craft a certificate request with forged cdc and rmd values, and the CA authenticates to your machine — returning a certificate stamped with a real Domain Controller’s identity. CVSS 8.8, network-accessible, low complexity, requires only a domain account. The PoC is public on GitHub as of July 24.
This Is Not an ESC Misconfiguration
The ESC series (ESC1 through ESC8) and the PetitPotam relay chains that dominated AD CS security for the past few years all exploited misconfigured templates or poorly secured web enrollment endpoints. The standard defensive advice — audit your templates, lock down the CA web endpoint, disable HTTP on ADCS — stops those attacks. It does not stop Certighost. This vulnerability lives in the CA’s internal trust logic, and it affects the default Machine template. Template hardening is irrelevant here. Teams that locked down their ESC exposure in 2024 and 2025 and assumed they were done are going to learn otherwise.
From Domain User to Domain Admin in Six Steps
The public exploit automates the full chain. An attacker with a regular domain account uses the default ms-DS-MachineAccountQuota setting — 10 by default, meaning any user can register up to ten machine accounts — to create a computer object. They launch listeners on ports 445 and 389, submit a malicious enrollment request, and wait for the CA to chase the bait. The CA authenticates to the attacker’s rogue service, receives fabricated identity data for a real Domain Controller (complete SID, hostname, and userAccountControl attributes), and issues a valid certificate for that DC. The attacker uses PKINIT to authenticate as the Domain Controller and runs DCSync to extract the krbtgt hash. From there: Golden Tickets, unlimited persistence, domain-wide access that survives password resets because certificates remain valid for a year or more.
Patch It. The Fix Exists.
Microsoft released the fix in the July 14, 2026 Patch Tuesday update. The patch adds _ValidateChaseTargetIsDC validation to certpdef.dll, which now rejects any cdc value that does not correspond to a legitimate AD computer object carrying the SERVER_TRUST_ACCOUNT flag, blocks IP literals and LDAP injection characters, and performs a SID comparison to prevent object substitution. Apply the update to every Domain Controller and AD CS server in your environment — not just a subset.
If patching immediately is not possible, Microsoft documented a temporary mitigation that disables the chase enrollment fallback entirely:
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -ForceBe aware this will break cross-forest enrollment and certain legitimate multi-domain workflows. Test before running in production and treat it as a temporary measure, not a long-term fix.
Detecting Exploitation Attempts
Three Windows event IDs are your primary signals. Event ID 4887 (certificate issued by CA) should alert when a Domain Controller machine certificate is issued to an account not in the Domain Controllers OU. Event ID 4768 (Kerberos TGT request) should alert on certificate-based pre-authentication (PreAuthType=16) from non-DC accounts — attacker tools produce TicketOptions starting with 0x4080, a reliable signature. Third: alert on DRS GetNCChanges requests (DCSync traffic) from IP addresses that are not your Domain Controllers. Any SIEM with AD CS audit logging enabled can build this detection chain.
Action List for Dev and Ops Teams
- Apply the July 2026 Patch Tuesday update to all AD CS servers and Domain Controllers immediately — this is the only complete fix.
- Audit CA event logs for suspicious DC certificate issuance using Event ID 4887.
- Add DCSync detection to your SIEM: alert on DRS replication requests from non-DC IPs.
- Review ms-DS-MachineAccountQuota — if your org does not need users to create computer accounts, set it to 0.
- If compromise is suspected: perform a double krbtgt password rotation — rotate once, wait ten or more hours (longer than the maximum Kerberos ticket lifetime), then rotate again. A single rotation does not invalidate all active tickets.
