Certighost lets any domain user forge a Domain Controller certificate
A low-privileged Active Directory account, no admin rights required, can now obtain a certificate for a Domain Controller and DCSync the krbtgt secret. Microsoft patched it 10 days before the public write-up landed.
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24, 2026 for a flaw Microsoft tracks as CVE-2026-54121 (CVSS 8.8) in Active Directory Certificate Services. Codenamed Certighost, it abuses an enrollment fallback in the Windows certificate enrollment protocol: an attacker with an ordinary domain account, no admin rights, runs rogue LSA and LDAP services and relays the certificate authority's authentication challenge to the real Domain Controller over Netlogon. The CA issues a certificate carrying the Domain Controller's own identity without properly validating the request. That certificate yields a Kerberos credential with directory replication rights, enough to DCSync the krbtgt secret and take the domain. Microsoft shipped a fix on July 14, ten days ahead of disclosure; no in-the-wild exploitation was confirmed as of publication.
Why it matters
This is a machine-identity flaw wearing an Active Directory costume: the target isn't a user's password, it's the certificate that lets a machine assert "I am this Domain Controller." Enrollment and issuance logic that trusted a relayed challenge is exactly the kind of certificate-lifecycle edge case that doesn't show up in a normal access review.
If you run AD CS with default Machine certificate templates and haven't confirmed you're past July 2026 patch levels on every DC and Windows 10/Server 2012 through 2025 host, that's the first thing to check, not just the ones internet-facing systems get.
Source: The Hacker News