CertiGhost (CVE-2026-54121) — A Standard Account Becomes a DC

Researchers publicly released a working exploit this week for a Windows vulnerability that lets any authenticated domain user — no admin rights, no phishing, no user interaction — walk away with a certificate that says they’re a Domain Controller. They named it CertiGhost. If you run an internal Microsoft PKI, and most enterprises do, this is the kind of bug that turns “someone has a normal user account” into “someone has your krbtgt secret” in a single afternoon.

What CVE-2026-54121 Actually Is

#

CVE-2026-54121 is an improper-authorization flaw in Active Directory Certificate Services (AD CS), rated CVSS 8.8. It lives in how an Enterprise Certification Authority resolves identity during certificate enrollment. Under specific cross-domain-controller scenarios, the CA performs a fallback lookup — researchers call it a “chase” — where it reaches out to a second host to confirm who’s really asking for a certificate. The bug is that the CA trusted the requester to name that second host itself, with no check that the host was an actual Domain Controller.

That’s the whole vulnerability in one sentence: the CA asked a stranger who it was talking to, and believed the answer.

How the Attack Chain Works

#

The certificate request format includes two attributes an attacker can set directly: cdc (the “client DC” host the CA should contact) and rmd (the machine object the CA should look up). A vulnerable CA opens SMB and LDAP connections to whatever host is named in cdc, and treats whatever identity data comes back as authoritative.

An attacker with only a standard domain account exploits this in a few steps:

1. Create (or reuse) a computer account — trivial under the default ms-DS-MachineAccountQuota value of 10, which lets any domain user register up to ten machine accounts.
2. Stand up rogue SMB/LSA and LDAP listeners on a host they control, and point the CA at it via the cdc attribute.
3. Relay the CA’s authentication challenge to a real Domain Controller over Netlogon, then hand the CA the target DC’s objectSid and dNSHostName as though the attacker’s box were authoritative.
4. Receive a signed certificate carrying the real Domain Controller’s identity.
5. Use that certificate via PKINIT to authenticate as the DC, then run DCSync to pull the krbtgt account secret and every other domain credential.

Step five is the part worth sitting with. Once an attacker has krbtgt, they can forge Kerberos tickets for any account, indefinitely, independent of password resets — the same Golden Ticket endgame that made Zerologon’s Netlogon impersonation trick so dangerous back in 2020. CertiGhost gets there through certificates instead of a cryptographic protocol flaw, but the destination — full, durable domain compromise from a standard user account — is identical.

Timeline: Quiet Disclosure, Loud Release

#

• May 14, 2026 — Researchers H0j3n and Aniq Fakhrul report the flaw to Microsoft.
• May 22, 2026 — Microsoft confirms it.
• July 14, 2026 — Microsoft ships the fix as CVE-2026-54121 in that month’s security updates, with no advance public detail.
• July 24, 2026 — The researchers publish full technical details and a working exploit tool on GitHub under the name “Certighost.”

Ten days between patch and public PoC is a familiar rhythm by now. It’s a shorter window than the SharePoint machine-key theft flaw from last week, but the same lesson applies: once the write-up lands, treat every unpatched instance as already targeted, whether or not a KEV listing confirms it yet. As of this writing there are no public reports of in-the-wild exploitation, but the barrier to entry here — a low-privileged account and network reachability to the CA — is low enough that “no reports yet” is not the same as “not happening.”

Who’s Actually Exposed

#

The affected surface is broad: any Enterprise CA integrated with Active Directory on Windows Server 2012 through Server 2025 (including Server Core), plus Windows 10 1607 and 1809. Practically, if your organization runs internal PKI for device certificates, VPN auth, smart-card logon, or code signing — which is most mid-size-and-up enterprises — you have at least one CA in scope. The only hard requirements for exploitation are network reachability to that CA and enrollment access through the default Machine certificate template, which is enabled out of the box in most deployments.

What to Do Right Now

#

1. Patch every AD CS/CA host with Microsoft’s July 14, 2026 security update. Verify the patch actually landed by checking the updated certificate validation logic rather than trusting a general OS patch-level check.
2. If you can’t patch immediately, disable the chase fallback — it’s an optional feature, not core request-handling code:

   certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
   Restart-Service CertSvc -Force

   Test this in non-production first; it can break legitimate cross-domain enrollment workflows that rely on the chase path.
3. Lower ms-DS-MachineAccountQuota from its default of 10 to reduce how easily a low-privileged account can spin up the computer accounts this attack needs.
4. Hunt your CA logs for certificate issuances tied to Domain Controller identities requested from new or rarely-used computer accounts, especially through the Machine template.
5. Check DC replication logs for Event ID 4662 (directory replication rights) tied to unexpected source accounts — the DCSync tell — and look for Golden Ticket indicators given the roughly two-month gap between Microsoft’s confirmation and the patch.
6. Alert on anomalous CA network activity: unexpected outbound SMB (445) or LDAP (389) connections from a CA server to a non-Domain-Controller host is exactly what an in-progress chase-abuse attempt looks like.

The Bigger Pattern

#

CertiGhost is another entry in a genre that keeps expanding: bugs where a system trusts a claimed identity instead of verifying it cryptographically against something it can’t fake. The NSA-discovered Windows CryptoAPI spoofing bug from 2020 broke certificate trust at the signature-validation layer; CertiGhost breaks it at the issuance layer instead, but the failure mode — a security boundary that takes an attacker’s word for who they are — rhymes uncomfortably well. And the ten-day patch-to-PoC window here reinforces the point made in why Patch Tuesday still matters: the gap between “fixed” and “safe” is measured in days now, not months, and your patching cadence has to close that gap faster than researchers close theirs.

My Take

#

What makes CertiGhost worth writing about isn’t the CVSS score — 8.8 is serious but not exotic — it’s how little an attacker needs to start the chain. No admin rights. No phishing email. No zero-click exploit. Just an ordinary domain account and the default machine-account quota every AD environment ships with. That’s the same story AD CS has told for years now, from ESC1 template misconfigurations to Certifried-style impersonation: certificate services are a soft, under-audited layer sitting quietly next to the identity infrastructure everyone actually watches. If your security monitoring covers failed logons and suspicious PowerShell but has no eyes on your CA’s enrollment logs, CertiGhost is your reminder that the blind spot has a name and a public exploit now.