BleepingComputer reported that a proof-of-concept exploit was released for Certighost, a Windows Active Directory Certificate Services vulnerability.
The vulnerability is tracked as CVE-2026-54121 and was fixed by Microsoft in the July 2026 Patch Tuesday updates.
Microsoft said an authenticated attacker could manipulate attributes associated with a machine account and obtain a certificate that allows authentication as that machine through PKINIT.
If a domain controller account can be targeted, an attacker could authenticate as the domain controller and perform privileged Active Directory operations.
The PoC automates certificate-based authentication as the targeted domain controller, saves Kerberos credentials to a .ccache file, and extracts the account’s NT hash.
Researchers demonstrated using the resulting Kerberos credentials with Impacket secretsdump to perform DCSync and retrieve the krbtgt account credentials.
A newly released proof-of-concept exploit is turning heads across enterprise security teams — and for good reason. Dubbed Certighost and tracked as CVE-2026-54121, the vulnerability targets Active Directory Certificate Services (AD CS), the PKI backbone that most Windows-based enterprises rely on for certificate-based authentication.
Microsoft patched the flaw in its July 2026 Patch Tuesday release. But the story didn’t end there. Ten days later, researchers publicly dropped a fully functional PoC, collapsing the gap between “theoretical risk” and “weaponized attack chain.”
What makes Certighost dangerous isn’t just the CVSS 8.8 score — it’s the blast radius. A single authenticated, low-privileged domain account is enough to manipulate machine-account attributes, forge a certificate impersonating a domain controller, and pivot straight into a full domain compromise via DCSync. For any organization running AD CS, this is no longer a hypothetical exercise in “what could happen.” It’s a live, public roadmap for what already can.
The root cause of Certighost lies in a fallback lookup process inside AD CS enrollment, which researchers have labeled the “chase” mechanism. When the Certification Authority (CA) processes a certificate request, it sometimes performs a secondary directory lookup to resolve the requester’s identity — and this lookup can be redirected to an attacker-controlled host.
The exploit chain works like this:
Machine account creation – A standard domain user leverages the default ms-DS-MachineAccountQuota value of 10, which permits any authenticated user to create up to 10 machine accounts with zero elevated privileges required.
Rogue listener setup – The attacker stands up fake SMB/LSA and LDAP services to intercept the CA’s chase lookup.
Identity coercion – When the CA reaches out during enrollment, it queries the attacker’s rogue services and receives falsified directory data — specifically the objectSid and dNSHostName of the targeted domain controller.
Certificate issuance – The CA, trusting this fabricated response, issues a certificate bound to the domain controller’s identity rather than the attacker’s actual machine account.
PKINIT authentication – The forged certificate is used to authenticate via PKINIT, yielding valid Kerberos credentials for the domain controller.
Privilege escalation – Because domain controller accounts hold directory replication rights, the attacker runs DCSync to extract the krbtgt account’s credentials — effectively obtaining the keys to forge unlimited domain access via Golden Tickets.
One of the most effective mitigations is to set the Active Directory ms-DS-MachineAccountQuota attribute to 0 if your organization does not require standard users to create computer accounts. This hardening measure prevents unprivileged users from creating new machine accounts, immediately breaking the first step of this exploit chain.
The entire chain requires only network reachability and a standard domain account — no administrative rights, no user interaction, and no prior foothold beyond basic domain membership.
What Is Workforce Identity? A Complete Guide for IT Teams
Workforce Identity helps IT teams secure users, devices, and enterprise access across today's hybrid workplaces.
The Hexnode Solution
Certighost is fundamentally a patching and identity-hygiene problem — which means the right tooling can compress both detection time and exposure window significantly.
Hexnode XDR applies behavioral analytics across managed Windows endpoints to flag anomalous activity patterns — including credential-harvesting techniques and unusual process behavior — that can surface early indicators of an in-progress attack chain like Certighost’s, such as suspicious credential access attempts or signs of privilege escalation on a domain-joined machine.
Hexnode UEM enforces automated, CVE/KB-criteria-based patch deployment across Windows endpoints and privileged administrator workstations, helping organizations keep the managed devices used to administer Active Directory and AD CS environments up to date with applicable security updates. Real-time compliance reporting gives IT teams audit-ready visibility into which managed Windows devices have applied the relevant July 2026 security updates and which remain exposed.
Hexnode IdP adds a critical containment layer: its compliance-based access control blocks login attempts from devices flagged as unenrolled or non-compliant within Hexnode UEM, so even if credentials are compromised via a Certighost-style attack, access from an untrusted or non-compliant endpoint can be denied outright. Continuous device-posture verification means access can be revoked mid-session the moment risk conditions change — a meaningful check against attackers attempting to leverage forged domain-controller credentials from outside the managed fleet.
Together, these capabilities don’t eliminate the need to patch — nothing does — but they shrink the practical window an attacker has to operationalize a PoC like Certighost inside your environment.
Featured Resource
Hexnode IdP Solution Brief
Check out this solution brief for a quick glance into Hexnode IdP's capabilities.
Certighost is a reminder that identity infrastructure is attack surface — not a background utility that quietly issues certificates and stays out of the security conversation. When a Certification Authority can be coerced into vouching for the wrong identity, every downstream trust decision built on that certificate becomes suspect.
For enterprises running AD CS, the response can’t stop at applying the July 2026 patch, though that remains the non-negotiable first step. Security teams should also:
Review Certification Authority behavior – Audit enrollment configurations and chase-related lookup paths for exposure, not just patch status.
Monitor Kerberos and DCSync indicators – Treat unusual PKINIT authentication attempts and replication requests as high-priority signals, not background noise.
Reclassify certificate abuse as a domain-compromise risk – Certificate misuse is no longer a niche PKI concern; it’s a direct path to full Active Directory takeover.
Restrict machine account creation – Set the Active Directory ms-DS-MachineAccountQuota attribute to 0 so non-administrator users cannot create rogue computer accounts. This immediately blocks the first step of the Certighost exploit chain while aligning with Active Directory hardening best practices.
The organizations that treat AD CS with the same scrutiny as their domain controllers — rather than as a “set it and forget it” service — will be the ones positioned to catch the next Certighost before it becomes a headline.
Try Hexnode free for 14 days
Secure your identity infrastructure before attackers do — try Hexnode free and see the difference.
I’m a technical content writer at Hexnode who loves simplifying tech. I break down complex ideas, remove the fluff, and help readers clearly understand our product for what it actually is: simple, reliable, and built to solve real problems.
