PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121)
Security researchers who discovered and reported CVE-2026-54121 (aka “Certighost”), a critical privilege elevation vulnerability in Active Directory Certificate Services (AD CS), have released a proof-of-concept (PoC) exploit for and technical details related to the flaw.
The vulnerability
AD CS is a Microsoft Windows Server role that lets an organization run its own Public Key Infrastructure (PKI). It acts as a Certificate Authority (CA), issuing and managing digital certificates used for authentication, encryption, and signing across a network.
CVE-2026-54121 is a critical improper-authorization flaw with a CVSS score of 8.8.
“An authenticated attacker could manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via [Public Key Cryptography for Initial Authentication in Kerberos],” Microsoft explained.
“If a Domain Controller account can be targeted, the attacker could authenticate as the Domain Controller and gain the ability to perform privileged Active Directory operations.”
Researchers Aniq Fakhrul and Muhammad Ali reported the bug to Microsoft in May 2026, and the company released fixes for the flaw on July 14, 2026.
At the time, Microsoft judged CVE-2026-54121 as “less likely” to be exploited, though it may revise its assessment now that the PoC has been made public.
How the exploit works
To exploit CVE-2026-54121, an attacker needs to have network access and a domain account.
The exploit takes advantage of a specific fallback behavior inside the AD CS Certification Authority (CA) during certificate enrollment.
Certighost exploitation (Source: Muhammad Ali)
When the CA processes an enrollment request, it needs to resolve the requester’s identity by looking up a directory object. In some cross-domain-controller enrollment scenarios, the CA may perform a second directory lookup (“chase”) by reaching out to another host to fetch it.
This chase can be steered by the requester through two attributes supplied in the certificate request: cdc (Client DC), which names the host the CA should contact, and rmd (Remote Domain), which names the principal the CA should look up.
When both are present, the CA opens SMB and LDAP connections to the (attacker-controlled) host named in cdc, searches for the principal named in rmd, and then uses whatever identity data it receives while building the certificate.
The reason the rogue endpoint passes the CA’s authentication checks at all is that a machine account created through the default ms-DS-MachineAccountQuota setting is itself a valid domain principal. This lets the attacker-controlled chase host satisfy the checks the CA requires to continue, even though it is not the Domain Controller being impersonated.
In the end, the attacker has at their disposal a CA-signed certificate that authenticates as a target Domain Controller, which can be used (via PKINIT) to obtain Kerberos credentials for that DC account.
Because Domain Controller accounts hold directory replication rights, the attacker can then run a DCSync operation to extract the krbtgt account secret – the master key underpinning Kerberos in the domain – thus turning what began as an ordinary domain-user account into full domain compromise.
Patch or mitigate
Microsoft’s July 2026 updates for various Windows 10 and Windows Server versions plug this hole by validating the “chase” target before the lookup proceeds.
Admins should upgrade affected AD CS hosts as soon as possible (if they haven’t already).
“If the July update cannot be installed immediately, the vulnerable code path can be switched off completely with a policy flag, because the cdc chase is an optional fallback feature, not code that runs on every request,” the researchers added.
This can be done by modifying the registry with certutil (certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC), then restarting the CA service (Restart-Service CertSvc -Force).
To date, there are no known reports of attackers exploiting the flaw in the wild.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!