CertiGhost: The Certificate That Shouldn’t Exist

Active Directory Certificate Services (AD CS) has long been a favorite target for attackers.

The recently disclosed CertiGhost (CVE-2026-54121 – our CVE of the Week) vulnerability demonstrates that even well-managed environments can still contain unexpected paths to full domain compromise.

Microsoft addressed the issue in its July 2026 security updates, but the public release of a working Proof-of-Concept (PoC) has significantly increased the risk for unpatched organizations.

What makes CertiGhost particularly noteworthy is that it does not require administrative privileges. Under specific conditions, a standard authenticated domain user can obtain a certificate that allows them to authenticate as a Domain Controller, potentially leading to complete Active Directory compromise.

The vulnerability affects a little-known AD CS enrollment fallback mechanism known as a“chase”. During certificate issuance, the Certification Authority (CA) may query additional directory information using attributes such as cdc (Client DC) and rmd (Remote Domain). Researchers discovered that vulnerable implementations failed to properly verify whether the supplied domain controller target was actually legitimate. This creates an opportunity for attackers to redirect the CA toward attacker-controlled services.

By manipulating the certificate enrollment process and returning crafted identity information associated with a Domain Controller, attackers can trick the CA into issuing a certificate containing trusted DC identity attributes. Once a Domain Controller certificate is obtained, the impact becomes severe. The attacker can authenticate using PKINIT as that Domain Controller and leverage replication privileges to perform DCSync operations. This may expose sensitive secrets such as the krbtgt account, enabling Golden Ticket level access and effectively resulting in a complete domain takeover.

This is especially important because the attack chain can begin with nothing more than a low-privileged user account. Organizations relying on AD CS should immediately verify that security updates have been deployed to Enterprise CA servers. Microsoft has also warned that the publication of the PoC increases the likelihood of exploitation attempts in the wild.

Defenders should focus on:

• Unusual AD CS certificate enrollment activity
• DCSync-related alerts and directory replication abuse
• Unexpected LDAP/SMB communications involving Certification Authorities
• Machine account creation activity

AD CS remains one of the most critical yet often under-monitored components in many Windows environments. While much attention has historically focused on misconfigurations Certighost shows that implementation-level vulnerabilities can be just as dangerous. Now is a good time to review AD CS exposure, validate patch status, and ensure detection coverage includes certificate abuse scenarios.

https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/

https://app.opencve.io/cve/CVE-2026-54121

Do you want to be protected from attacks like the above? See our defensive services here: Managed Security – White Hat IT Security