A proof-of-concept exploit dubbed “Certighost” has been publicly released for a vulnerability in Windows Active Directory Certificate Services (AD CS) that lets a low-privileged domain user impersonate a domain controller and take over an entire Windows domain. The flaw, tracked as CVE-2026-54121, was patched by Microsoft in the July 2026 Patch Tuesday updates, but the public exploit raises the pressure on organisations that haven’t yet applied those patches.
The vulnerability exploits a fallback mechanism inside AD CS called a “chase,” which the certificate authority uses when it can’t locate an account locally. During this process the CA reaches out to a server named in the attacker-controlled certificate request. Before the fix, there was no check that this server was a legitimate domain controller, allowing an attacker to point the CA at a rogue machine, feed it fabricated identity information, and receive a certificate valid for authenticating as a real domain controller. With that certificate in hand the attacker can run a DCSync attack, extract the krbtgt account’s credentials, and gain full administrative control over the domain. Researchers H0j3n and Aniq Fakhrul disclosed the technical details after Microsoft’s fix landed and have released certighost.py to automate the attack chain.
How to check if you’re affected
Affected versions include any Windows Server environment running Active Directory Certificate Services that has not applied Microsoft’s July 2026 security updates. To confirm your patch level, open Windows Update or run Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 in PowerShell and verify July 2026 Patch Tuesday updates are present. Organisations that cannot patch immediately can disable the vulnerable fallback with:
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force
The researchers note this workaround has not been fully tested in all production configurations, so patching the July 2026 cumulative update remains the correct fix.