Certighost PoC Shows How CVE-2026-54121 Can Enable Windows Domain Compromise
Summary
A proof of concept for the AD CS flaw CVE-2026-54121 demonstrates how an authenticated attacker could impersonate a domain controller. Microsoft patched the flaw in July 2026; researchers describe a temporary workaround.
Key points
- Certighost abuses AD CS's certificate-enrollment chase mechanism, using the cdc and rmd request values to direct the CA to an attacker-controlled endpoint.
- Researchers say a low-privileged domain user could use a machine account to satisfy authentication checks and, in the tested configuration, obtain a certificate for a targeted domain controller.
- The proof of concept automates PKINIT authentication; researchers demonstrated using the resulting credentials for DCSync and retrieval of the krbtgt account's credentials.
- Microsoft fixed CVE-2026-54121 in its July 2026 security updates by validating the specified server and returned identity.
- Researchers describe disabling the optional chase fallback as a temporary workaround, but say it has not been fully tested in production; they recommend installing the updates.
Article Details
- Vulnerability Types
- Active Directory Certificate Services (AD CS) chase fallback validation flaw
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Temporarily disable the optional chase fallback using `certutil -setreg policyEditFlags -EDITF_ENABLECHASECLIENTDC` and restart the Certificate Services service with `Restart-Service CertSvc -Force`; researchers say this mitigation has not been fully tested in production.
MITRE ATT&CK
T1003.006 · DCSyncThe researchers demonstrated using the resulting Kerberos credentials with Impacket's secretsdump to perform DCSync and retrieve the krbtgt credentials.T1078.002 · Domain AccountsThe exploit uses a certificate to authenticate as the targeted domain controller account and perform privileged Active Directory operations.T1136.002 · Domain AccountThe demonstrated attack begins with a low-privileged domain user creating a machine account.T1649 · Steal or Forge Authentication CertificatesThe exploit causes AD CS to issue a certificate that the attacker uses to authenticate as a targeted domain controller through PKINIT.
CVE
People
Vendors
Products
Active Directory Certificate ServicesCertighost, tracked as CVE-2026-54121, shows how an authenticated attacker could abuse Active Directory Certificate Services to impersonate a domain controller and potentially compromise a Windows domain.Microsoft WindowsActive Directory Certificate Services to impersonate a domain controller and potentially compromise a Windows domain.
Tools
certighost.pyThe released certighost.py proof-of-concept automates this process by using the certificate to authenticate through PKINIT as the targeted domain controller, saving the resulting Kerberos credentials to a .ccache fileImpacketThe researchers then demonstrated using the saved Kerberos credentials with Impacket’s secretsdump tool to perform a DCSync attack and retrieve the krbtgt account’s credentials.secretsdumpThe researchers then demonstrated using the saved Kerberos credentials with Impacket’s secretsdump tool to perform a DCSync attack and retrieve the krbtgt account’s credentials.