PoC Exploit for Certighost Flaw Enables Windows Domain Hijacking
A newly released proof-of-concept exploit for "Certighost" demonstrates how authenticated attackers can hijack Windows domains by exploiting a vulnerability in Active Directory Certificate Services (AD CS). Tracked as CVE-2026-54121, the flaw allows low-privileged domain users to impersonate a Domain Controller and gain administrative control over the entire domain. Microsoft addressed the vulnerability in its July 2026 Patch Tuesday security updates after researchers H0j3n and Aniq Fakhrul reported it in May.
The vulnerability exists in a fallback mechanism within AD CS that handles certificate enrollment requests through a process called a "chase." This mechanism relies on two values: the Client DC (cdc), which specifies a server for the Certification Authority to contact, and the Remote Domain (rmd), which identifies the account to search for. The critical flaw is that the system does not verify whether the server specified in the attacker-controlled cdc value is actually a legitimate domain controller.
By manipulating these attributes, an attacker obtains a certificate that allows them to authenticate as a target machine via PKINIT. If the attacker targets a domain controller account, they can authenticate as that controller and execute privileged Active Directory operations. Security experts urge organizations that have not yet applied the July 2026 patches to do so immediately, as the public release of technical details and exploit code significantly raises the risk of active exploitation.