Certighost CVE-2026-54121: patch your Active Directory

The worst Active Directory bugs aren't the ones that need admin rights. They're the ones that need any account — the seasonal hire, the contractor who left, the credential from last quarter's phishing test that actually worked. On July 24, researchers H0j3n and Aniq Fakhrul published Certighost with a working proof-of-concept: CVE-2026-54121, an Active Directory Certificate Services flaw that walks a low-privileged domain user up to domain controller impersonation and out with the krbtgt secret.

What actually happened

The flaw is an improper-authorization bug rated CVSS 8.8 in how AD CS handles an enrollment fallback the researchers call the "chase" mechanism. When the CA can't resolve end-entity information on its own, it follows a host supplied by the requester over SMB and LDAP — without first proving that host is a real domain controller. That's the whole bug: the CA trusts the requester's word about who it's talking to.

The exploit chain, per the researchers' write-up: create or reuse a controlled machine account, stand up rogue LSA and LDAP listeners on ports 445 and 389, relay the CA's Netlogon challenge to a real DC, harvest the target DC's objectSid and dNSHostName, submit falsified attributes, then use PKINIT to authenticate as that DC and run DCSync. The payoff is krbtgt — the key that mints Kerberos tickets for the entire domain. Their certighost.py chains all of it in a single run.

Requirements are modest: network reachability and a valid domain account, no admin rights, an Enterprise CA in a vulnerable chain path, and default Machine template enrollment. Affected systems span Windows Server 2012 through 2025, including Server Core, plus Windows 10 1607 and 1809.

Microsoft shipped the fix in the July 14, 2026 Patch Tuesday; the update adds validation in certpdef.dll that rejects IP literals, overlong names, and LDAP metacharacters, and requires a matching AD computer object with the SERVER_TRUST_ACCOUNT flag. As of publication there was no confirmed exploitation in the wild.

Why it matters for your business

The dangerous assumption is "we're too small to run AD CS." Plenty of small offices have a certificate authority they never chose — it came along with Wi-Fi or VPN certificates, or a line-of-business app that wanted them, and nobody has logged into that server since. That box is now the shortest path from any employee account to full domain compromise.

Do three things this week. Confirm the July 14 update is actually applied to every Windows Server, not just the ones your patch dashboard reports as healthy. Find out whether you run an Enterprise CA at all — if you can't answer that in five minutes, that's the finding. And if you can't patch immediately, the researchers' temporary mitigation disables the chase fallback:

certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force

The ten days between Microsoft's patch and a public PoC were your grace period. It's over.

Sources: The Hacker News, Cyber Security News.