Certighost lets any domain user forge a Domain Controller certificate
A low-privileged Active Directory account, no admin rights required, can now obtain a certificate for a Domain Controller and DCSync the krbtgt secret. Microsoft patched it 10 days before the public write-up landed.
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24, 2026 for a flaw Microsoft tracks as CVE-2026-54121 (CVSS 8.8) in Active Directory Certificate Services. Codenamed Certighost, it abuses an enrollment fallback in the Windows certificate enrollment protocol: an attacker with an ordinary domain account, no admin rights, runs rogue LSA and LDAP services and relays the certificate authority's authentication challenge to the real Domain Controller over Netlogon. The CA issues a certificate carrying the Domain Controller's own identity without properly validating the request. That certificate yields a Kerberos credential with directory replication rights, enough to DCSync the krbtgt secret and take the domain. Microsoft shipped a fix on July 14, ten days ahead of disclosure; no in-the-wild exploitation was confirmed as of publication.
Why it matters
This is a machine-identity flaw wearing an Active Directory costume: the target isn't a user's password, it's the certificate that lets a machine assert "I am this Domain Controller." Enrollment and issuance logic that trusted a relayed challenge is exactly the kind of certificate-lifecycle edge case that doesn't show up in a normal access review.
If you run AD CS with default Machine certificate templates and haven't confirmed you're past July 2026 patch levels on every DC and Windows 10/Server 2012 through 2025 host, that's the first thing to check, not just the ones internet-facing systems get.
Source: The Hacker News
Related on Start with Identity
- BlogNHI Hound maps the trust paths dormant service accounts leave into your identity provider
Ahead of a Black Hat USA 2026 release, researcher Aleksandr Krasnov built NHI Hound, an open source tool that ingests identity data from Okta, GitHub, and cloud
- Blognpm 12 turns off install scripts, and starts killing 2FA-bypass tokens
npm 12 stops running dependency lifecycle scripts unless you allow them. The quieter half is the identity change: granular access tokens that bypass 2FA lose ac
- BlogSynthetic identity fraud has a machine-identity version now
Instead of stealing an existing service account, attackers are fabricating new ones that blend real environmental attributes with fake ones, inheriting legitima
- CVEsamlify signature wrapping, forge SAML as any user
samlify before 2.10.0 accepted wrapped SAML signatures (CWE-347). An attacker can forge responses and impersonate any user, including admins. Node shops hit thi
- CVESharePoint JWT validation chain, forge a token and become any user
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026
- CVEHaloITSM SAML signature wrapping, log in as any user
HaloITSM accepted a wrapped SAML assertion. An attacker with one valid signature could impersonate any user, including admins. Critical. Another 2024 reminder t