Reported by 2 outlets

Timeline

1. original reporting

   Certighost CVE-2026-54121: Public PoC Enables Low-Privilege AD CS Domain Takeover

   cybersecuritynews.com · 80d ago · July 26th, 2026

   A public, fully working proof-of-concept exploit dubbed "Certighost" has been released for CVE-2026-54121, a critical Active Directory Certificate Services (AD CS) vulnerability that allows any authenticated domain user — with no admin rights — to impersonate a Domain Controller and extract the krbtgt secret, enabling full Active Directory domain compromise.

   Key details:

   • Any low-privilege domain user can forge a Domain Controller certificate

   • Extracting krbtgt enables Golden Ticket attacks for persistent domain access

   • Microsoft patched the flaw in July 14, 2026 Patch Tuesday

   • Discovered by researchers @h0j3n and reported through ZDI

   • Public exploit code is now available on GitHub

   This is the latest in a series of AD CS-focused vulnerabilities following Certipy, ESC1-ESC13, and Pass the Certificate attacks. AD CS continues to be a high-value attack surface because certificate services run with elevated privileges and are often deployed without the hardening attention given to core AD infrastructure.

   Action: If not already patched, apply the July 14 Microsoft security update immediately. After patching, audit AD CS for signs of abuse — look for unexpected certificate requests from non-DC machines, anomalous Kerberos TGT requests, and unauthorized certificate templates. Treat any unpatched domain controller as potentially compromised.

   ---

2. update from bleepingcomputer.com

   Certighost CVE-2026-54121: Public PoC Enables Low-Privilege AD CS Domain Takeover

   bleepingcomputer.com · 78d ago · July 28th, 2026

   Previously identified as a gap on Jul 26. New today: BleepingComputer reports exploit release with full technical detail.

   A proof-of-concept exploit for Certighost (CVE-2026-54121) has been publicly released. Key details:

   • Discovered by researchers H0j3n and Aniq Fakhrul, reported to Microsoft May 14, 2026

   • Patched in July 14, 2026 Patch Tuesday (last Tuesday is 2 weeks ago now)

   • Attacker manipulates machine account attributes to obtain a certificate allowing authentication as that machine via PKINIT

   • Targeting a Domain Controller account enables privileged AD operations

   Action: If not already patched, apply the July 14 Microsoft update immediately. Given the patch is 2 weeks old and PoC code is now public, expect scanning activity.