Certighost CVE-2026-54121 Active Directory Certificate Services Elevation of Privilege Details and PoC Exploit Code Go Public
Do Son 
TL;DR
Researchers have published full technical details and working proof-of-concept code for Certighost, tracked as CVE-2026-54121. The Certighost AD CS vulnerability let a low-privileged domain user impersonate a Domain Controller and reach domain compromise. Microsoft fixed the issue in the July 2026 Patch Tuesday release, and the bug carries a CVSS score of 8.8.
- CVE: CVE-2026-54121
- CVSS: 8.8 (High · CVSSv3)
- Product: Microsoft Windows 10 Version 1607
- Affected: 10.0.14393.0, 10.0.17763.0, 6.2.9200.0, 6.3.9600.0, 10.0.20348.0, 10.0.26100.0
- Impact: Active Directory Certificate Services Elevation of Privilege Vulnerability
- Status: No confirmed exploitation yet
- Patched in: 10.0.14393.9339, 10.0.17763.9020, 6.2.9200.26226, 6.3.9600.23291 (+2 more)
- EPSS: 1.1% (30-day)
- Action: Update to 10.0.14393.9339, 10.0.17763.9020, 6.2.9200.26226, 6.3.9600.23291 (+2 more) now
Why It Matters
AD CS issues the certificates that back Kerberos authentication across a Windows domain. A certificate that carries a Domain Controller identity is therefore close to a master key. Any ordinary user could reach the vulnerable path, because the default ms-DS-MachineAccountQuota setting lets them create a machine account. Now that details and exploit code are public, unpatched certificate authorities carry real risk.
How the Attack Works
The chase fallback
Some cross-domain-controller enrollment scenarios push the CA into a second directory lookup, called a chase. Two request attributes steer it. The cdc attribute names the host the CA should contact, while rmd names the principal it should look up. Given both, the CA opens SMB and LDAP connections to that host and searches for the named principal.
Where trust breaks
The CA accepted the requester-supplied chase target without proving it was a genuine Domain Controller. An attacker could therefore stand up rogue LDAP and LSA services, point the CA at them, and answer its lookups. The rogue endpoint returned a Domain Controller’s objectSid and dNSHostName. Those values then shaped the certificate the CA issued, including the strong-mapping SID and DNS identity fields. Certificate authentication afterward succeeded as the target Domain Controller, which opened the door to replication access.
Public Disclosure and Exploitation Status
The researcher’s public technical write-up walks through the chase path and what the update changed. A certighost.py proof-of-concept now sits on GitHub as well. Microsoft’s own entry for the flaw appears in the MSRC update guide. No exploitation in the wild has been confirmed so far. A public exploit still shortens the runway for attackers.
Affected Versions
The bug sits in the AD CS role and is classed as improper authorization, CWE-285. Microsoft’s advisory covers supported Windows Server versions running that role. Systems patched with the July 2026 security updates are no longer affected.
Patch and Mitigation Steps
Apply the July 2026 updates to every certificate authority, not only to Domain Controllers. Patching is the fix; everything below is defense in depth.
Set ms-DS-MachineAccountQuota to zero so ordinary users cannot create machine accounts. Watch CA hosts for outbound SMB or LDAP connections to systems that are not Domain Controllers. Review certificate request logs for unusual cdc and rmd attributes. Tighten enrollment permissions on templates, and treat the CA as a tier-0 asset alongside your Domain Controllers. Given the public code, treat this Certighost AD CS vulnerability as an urgent patch item.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
