A New Exploit Turns Any Domain User Into a Domain Controller. It Dropped on a Friday. Patch Your CA Before You Log Off.
- Patrick Duggan
- 45 minutes ago
- 4 min read
If you run Active Directory Certificate Services — and if you have an on-prem Windows domain of any size, you probably do — stop what you're doing and confirm your certificate authority servers took the July 2026 patch. A working exploit for CVE-2026-54121, which the researchers who published it this afternoon are calling Certighost, lets an ordinary domain user with no special privileges walk out with a domain controller's identity and, from there, the keys to your entire directory. It landed on a Friday, which means the people who'd use it have all weekend and the people who'd stop it are logging off. Do this one before you do.
What it actually does
The short version: a normal Domain Users account becomes a domain controller.
The longer version is a clean piece of AD CS abuse. The vulnerability lives in an enrollment fallback the certificate authority performs while resolving directory objects — a step the researchers call a "chase." By sending a certificate request as a computer account and attaching a crafted attribute (a cdc value) that points the CA at an attacker-controlled host, the attacker gets the CA to ask their machine for the identity data of a real domain controller — and then the CA issues a certificate using that borrowed identity. The attacker stands up two rogue listeners to catch the callback (an SMB/LSA server on port 445 and an LDAP server on 389), names the target DC in a second attribute, and the CA hands them a certificate that authenticates as that domain controller.
Here's why that's the whole game and not just a clever trick. Domain controller accounts carry directory replication rights. Once you can authenticate as a DC, you can run DCSync — and DCSync pulls the krbtgt secret. The krbtgt hash is the master key that signs every Kerberos ticket in the domain. With it, an attacker forges Golden Tickets, impersonates anyone, and persists through password resets. Low-privileged domain user to full, durable domain compromise, in one chain.
What it takes to run it — and why most domains qualify
This is not a niche prerequisite stack. Exploitation needs only network access and any domain account — no admin rights, no user interaction, no phishing. The attacker creates a computer account, which any Domain User can do by default because ms-DS-MachineAccountQuota ships set to 10. The environment just needs an Enterprise CA that follows the vulnerable chase path, enrollment available through the default Machine template (a common default), and network reachability from the CA to the attacker's listeners. That describes an enormous number of real-world AD CS deployments. Rated CVSS 8.8, affecting all supported Windows Server versions.
The playbook — in order
Patch every CA server. Now. The July 2026 security updates close it by fixing the trust boundary: the CA no longer accepts a chase endpoint just because it answers like a domain principal. This is the fix; everything below is for the gap between reading this and finishing the patch.
Set `ms-DS-MachineAccountQuota` to 0. There is almost never a good reason for ordinary users to create computer accounts, and this is a long-standing AD CS hardening step that breaks the first move of Certighost and a whole family of ESC-class attacks along with it. If you've never done it, do it today regardless of this CVE.
Lock down the Machine template and enrollment. Audit which principals can enroll through the default templates. AD CS misconfiguration is the gift that keeps giving — Certipy and the ESC catalog exist because default enrollment permissions are routinely too open.
Control egress from the CA. A certificate authority reaching outbound to arbitrary hosts on SMB (445) and LDAP (389) is the observable heart of this exploit. Your CA should not be making those connections to anything but known infrastructure — restrict it and you blind the callback.
Hunt for what it leaves. Watch for computer-account creation by non-administrative users, certificate requests carrying unusual cdc/rmd attributes, and — most important — DCSync from anything that isn't a domain controller. Unexpected directory-replication requests are the sound of this attack succeeding.
If you suspect it fired, assume the domain is owned. A stolen krbtgt is not a "reset the user's password" problem. It requires the double krbtgt rotation to actually evict the attacker, because a single rotation leaves a window they can ride. Treat a confirmed Certighost against your CA as a full domain-compromise incident, not a patch-and-move-on.
The point
The AD CS attack surface has been quietly one of the richest paths to domain takeover for years — the ESC family, Certifried back in 2022, and now Certighost — because certificate services sit at the trust center of the domain and their defaults are permissive. A weaponized exploit dropping into that surface on a Friday afternoon is close to a worst-case timing, because the asymmetry is brutal: the attacker needs one domain account and a weekend; you need every CA patched before Monday. Go confirm the update landed, set the machine-account quota to zero while you're in there, and don't let this be the thing you read about in your own incident report next week.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.