Attackers Hijack Windows Domains

Overview

A proof‑of‑concept exploit for Certighost, a vulnerability in Windows Active Directory Certificate Services (AD CS), has been released, raising serious concerns for enterprise environments. Tracked as CVE‑2026‑54121, the flaw was patched by Microsoft in the July 2026 Patch Tuesday updates. However, the public release of exploit code means organizations must urgently apply fixes to prevent domain compromise.

How Certighost Works

• Vulnerability: Allows authenticated attackers to manipulate machine account attributes and obtain certificates that enable authentication via PKINIT.
• Impact: Attackers can impersonate a Domain Controller (DC), gaining domain‑level administrative capabilities.
• Attack chain:
  1. Low‑privileged user creates a machine account (permitted by default ms-DS-MachineAccountQuota).
  2. Attacker abuses AD CS “chase” mechanism, supplying rogue cdc (Client DC) and rmd (Remote Domain) values.
  3. Certification Authority (CA) connects to attacker‑controlled services, trusting false directory information.
  4. CA issues a certificate that authenticates the attacker as a domain controller.
  5. Exploit script (certighost.py) uses the certificate to authenticate via PKINIT, saving Kerberos credentials and extracting NT hashes.
  6. Tools like Impacket secretsdump can then perform a DCSync attack, retrieving the krbtgt account’s credentials.

Proof‑of‑Concept Exploit

The released certighost.py PoC automates the attack, demonstrating how a low‑privileged user can escalate to full domain compromise. Researchers showed that with Kerberos credentials from a DC, attackers can replicate directory data and extract sensitive secrets.

Microsoft’s Fix

• Patch Tuesday July 2026: Microsoft added validation to the chase process, ensuring the cdc attribute maps to a legitimate domain controller and the returned identity matches the expected account.
• Temporary mitigation (for admins unable to patch immediately):Codecertutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC Restart-Service CertSvc -Force Researchers caution this is not fully tested and should only be used until patches are applied.

Defensive Guidance

Admins should:

• Install July 2026 updates immediately.
• Disable chase fallback if patching is delayed.
• Audit machine account creation to detect abuse of ms-DS-MachineAccountQuota.
• Monitor certificate requests for anomalies involving rogue endpoints.
• Detect DCSync attempts using Kerberos credentials.

Expert in the Cloud Insight

Certighost highlights the fragility of certificate‑based trust in Active Directory. By exploiting a fallback mechanism, attackers can escalate from low privilege to full domain compromise without exploiting traditional memory bugs. For defenders, the lesson is clear: patching AD CS is non‑negotiable, and monitoring certificate issuance must become a core part of enterprise security operations.