Swati KhandelwalJul 24, 2026Vulnerability / Enterprise Security
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine.
They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.
Microsoft patched the Active Directory Certificate Services (AD CS) issue ten days earlier as CVE-2026-54121. Microsoft classed the flaw as improper authorization and assigned it a CVSS score of 8.8.
Exploitation requires network access and a domain account, but no administrator rights or user interaction. In the researchers' test, a normal Domain Users account could create a computer account under the default ms-DS-MachineAccountQuota value of 10 or reuse one it already controlled.
