The Certighost exploit highlights one of the most dangerous areas in enterprise identity security: Active Directory Certificate Services.

Active Directory is already the control plane for most Windows enterprise environments. It manages users, computers, authentication, groups, permissions, Kerberos, and trust relationships. When certificate services are added to that environment, they become part of the authentication backbone. If that layer is misused or vulnerable, attackers may not need to steal an administrator’s password. They may be able to mint trust.

Certighost targets a vulnerability tracked as CVE-2026-54121 in Active Directory Certificate Services. The issue allows a low-privileged domain user to obtain a certificate for a Domain Controller under certain conditions. Once that certificate is obtained, the attacker can authenticate as the Domain Controller itself.

That is extremely serious. A Domain Controller is not an ordinary server. It holds the keys to the kingdom: directory replication rights, Kerberos trust, password hashes, account information, group memberships, policy data, and authentication material. Impersonating a Domain Controller can quickly become full domain compromise.

The reported exploit path is especially concerning because it does not require administrator rights or user interaction. The attacker needs network access and a normal domain account. In many breaches, that level of access is already available after phishing, credential theft, VPN compromise, endpoint malware, or abuse of a low-privileged employee account.

The exploit relies on conditions involving an Enterprise Certification Authority, certificate enrollment behavior, the Machine certificate template, and machine-account creation or reuse. In default Active Directory environments, ordinary domain users may be allowed to create a limited number of computer accounts because of the `ms-DS-MachineAccountQuota` setting. That default convenience can become part of the attack chain, because apparently defaults are where attackers go shopping.

Once the attacker obtains a certificate representing the Domain Controller, they can use Kerberos authentication through PKINIT. From there, they may be able to perform DCSync and retrieve sensitive secrets, including the `krbtgt` secret. Compromise of `krbtgt` is especially dangerous because it can allow attackers to forge Kerberos tickets and maintain deep, long-term control over the domain.

This is why AD CS vulnerabilities are so dangerous. Certificates can provide authentication without using the original password. If an attacker obtains a valid certificate for a privileged identity, changing that identity’s password may not be enough. The certificate path, template permissions, enrollment behavior, and trust chain must also be addressed.

Organizations running AD CS should immediately confirm whether their Certificate Authorities received Microsoft’s July 14, 2026 update for CVE-2026-54121. All Enterprise CA servers should be inventoried, including older, backup, test, disaster-recovery, and forgotten certificate servers. The forgotten CA is usually the one quietly holding production trust while everyone pretends the diagram is accurate.

Patching should be treated as urgent. Even if there are no confirmed reports of widespread exploitation, public exploit code changes the risk. Once a working exploit is available, defenders are not dealing with theory. They are dealing with repeatable attack steps that can be tested by ransomware groups, red teams, access brokers, and espionage actors.

Administrators should also review AD CS configuration. Certificate templates should be checked for enrollment permissions, subject-name controls, client authentication usage, manager approval requirements, and whether low-privileged users or broad groups can request certificates that could be abused.

Machine-account creation rights should be reviewed. If the default `ms-DS-MachineAccountQuota` is not required, organizations should consider reducing it and enforcing a controlled process for computer-account creation. Ordinary users should not be able to create machine accounts unless there is a clear operational need.

Security teams should monitor for suspicious certificate enrollment activity. This includes unusual Machine certificate requests, requests involving Domain Controller identities, enrollment from unexpected hosts, certificate requests immediately followed by Kerberos authentication, and newly created computer accounts used in certificate-related activity.

Administrators should review CA logs, Windows event logs, Kerberos logs, Netlogon activity, LDAP activity, and certificate issuance records. Any certificate issued for a Domain Controller identity should be validated against expected enrollment behavior. If the certificate was not requested by the legitimate Domain Controller, it should be treated as a major incident.

Detection should also include DCSync activity. Security teams should watch for directory replication requests from systems that are not legitimate Domain Controllers. DCSync from a workstation, newly created computer account, or unfamiliar host is a serious warning sign.

If exploitation is suspected, the response must go beyond patching. The organization should revoke malicious certificates, publish updated certificate revocation information, review issued certificates, rotate affected credentials, investigate DCSync activity, examine `krbtgt` exposure, and consider a controlled `krbtgt` reset process where required.

Because AD compromise can be persistent, incident responders should also check for new privileged accounts, suspicious group membership changes, Golden Ticket indicators, modified Group Policy, new service principals, shadow credentials, rogue certificate templates, altered CA settings, and unexpected trust changes.

This vulnerability is also a reminder that identity infrastructure must be monitored like production infrastructure. Too many organizations treat AD CS as something configured years ago and then left alone because certificates are “just working.” That is how quiet systems become excellent hiding places for attackers.

The key lesson is that certificate-based authentication can be both powerful and dangerous. When certificate issuance is abused, attackers can bypass normal password-focused defenses and impersonate high-value identities.

Certighost should push organizations to patch AD CS immediately, audit certificate templates, restrict enrollment rights, review machine-account creation, monitor certificate issuance, hunt for DCSync activity, and validate Domain Controller authentication paths.

Active Directory is not only a directory. It is the identity foundation of the enterprise. If attackers can convince the certificate authority to vouch for them as a Domain Controller, the domain’s trust model starts working for the attacker instead of the business. That is not a small configuration issue. That is the security architecture quietly betraying itself with a signed certificate.

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.

Source: Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller via The Hacker News — published 24 Jul 2026.