Proof-of-concept exploit released for Certighost Windows AD CS vulnerability

Reported by Bleeping Computer. A proof-of-concept exploit was released for a vulnerability in Windows Active Directory Certificate Services (AD CS) known as Certighost, potentially allowing authenticated attackers to compromise an entire Windows domain.

Tracked as CVE-2026-54121, the Certighost vulnerability was patched by Microsoft in its July 2026 security updates. The flaw allows an authenticated attacker to manipulate machine account attributes and obtain a certificate from AD CS. This certificate can then be used to authenticate as a targeted machine, including domain controllers. By impersonating a domain controller, an attacker could perform privileged Active Directory operations. Researchers H0j3n and Aniq Fakhrul discovered the vulnerability and disclosed it publicly with an exploit. The exploit leverages a fallback mechanism in AD CS, known as a "chase," where an attacker can direct the Certification Authority to a rogue server. This server can then return false information about a machine account, allowing the attacker to obtain a certificate that grants domain-level administrative privileges. The released proof-of-concept automates this process, enabling attackers to extract sensitive credentials, such as the krbtgt account's NT hash, through a DCSync attack. Microsoft has since addressed the vulnerability by adding validation to the chase process, ensuring the CA verifies legitimate domain controllers.

Source: Bleeping Computer