A recently identified vulnerability, referred to as Certighost, permits low-privileged Active Directory users to obtain a certificate for a Domain Controller and authenticate as that machine. This exploit was made public by researchers H0j3n and Aniq Fakhrul on July 24, 2026.
Details of the Vulnerability
The flaw, classified as CVE-2026-54121, was patched by Microsoft on July 14, 2026. It has been rated with a CVSS score of 8.8, indicating a high severity level due to improper authorization. Exploitation of this vulnerability requires network access and a domain account, but notably, it does not necessitate administrator rights or user interaction.
Mechanics of the Exploit
In their tests, the researchers demonstrated that a standard Domain Users account could create or reuse a computer account under the default ms-DS-MachineAccountQuota value of 10. The exploit also necessitates an Enterprise Certificate Authority (CA) that follows a vulnerable chain path and uses the default Machine template. The attack can occur if there is network reachability from the CA to the attacker’s SMB and LDAP listeners.
Potential Impact and Mitigations
The exploit allows attackers to retrieve the krbtgt secret through DCSync, which can lead to further privilege escalation within the network. As of July 24, there have been no confirmed reports of exploitation in the wild, although the proof-of-concept for the exploit is publicly available. This absence of reports does not rule out the possibility of exploitation occurring.
For organizations operating an Enterprise CA, it is crucial to apply the July 14 updates to AD CS hosts. If immediate patching is not feasible, the researchers suggest a temporary mitigation by disabling the chase fallback, although this may disrupt legitimate enrollment processes. This can be done using the command: certutil -setreg policyEditFlags -EDITF_ENABLECHASECLIENTDC followed by Restart-Service CertSvc -Force.
Conclusion
The Certighost vulnerability highlights significant security risks for organizations using Microsoft Active Directory. Administrators are advised to prioritize the application of the patch and consider the temporary mitigations while assessing their security posture against potential exploitation.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
