Windows Domains Left Vulnerable by Unpatched Certighost Exploit
A potentially devastating vulnerability has been unearthed in Windows Active Directory Certificate Services, allowing authenticated attackers to hijack entire domains. The proof-of-concept exploit, dubbed “Certighost,” can be used to compromise even the most secure of networks.
This critical flaw was patched as part of Microsoft’s July Patch Tuesday security updates, but many organizations may not have applied the fix yet, leaving their domains exposed. The vulnerability affects Active Directory Certificate Services (AD CS), which is responsible for issuing certificates for authentication and secure communications within Windows domains.
The Certighost exploit works by manipulating attributes associated with a machine account in Active Directory. An attacker can create a low-privileged domain user and then use the “chase” mechanism, a fallback process used by AD CS during certificate enrollment requests, to impersonate a Domain Controller. This allows the attacker to obtain a certificate that enables them to authenticate as that machine via Public Key Infrastructure (PKINIT).
The chase mechanism is a critical component of AD CS, but it also contains a flaw that allows an attacker to direct the Certificate Authority (CA) to a rogue server, which returns false directory information for a targeted machine account. This permits the attacker to run malicious services on the domain controller and extract sensitive credentials.
Security researchers H0j3n and Aniq Fakhrul first reported the vulnerability to Microsoft in May 2026, but it wasn’t until last week that they publicly disclosed the technical details of the exploit. The researchers released a proof-of-concept tool called certighost.py, which automates the process of creating a machine account, submitting a certificate request, and extracting Kerberos credentials.
The exploitation process is straightforward: an attacker creates a low-privileged domain user, adds it to AD CS, and then uses the chase mechanism to impersonate a Domain Controller. The Certignost exploit then uses these credentials to authenticate through PKINIT as the targeted domain controller. This allows the attacker to request account secrets, including the krbtgt secret.
For organizations that haven’t yet applied the July Patch Tuesday updates, it’s essential to take immediate action to protect their domains from this critical vulnerability. Installing the latest security patches should be done with all due haste, and administrators should also verify that their AD CS configuration is up-to-date.
In conclusion, the Certighost exploit highlights the importance of regular patching and maintaining a secure Active Directory environment. It’s crucial for organizations to prioritize the protection of their networks and take proactive measures to prevent potential attacks.
Source: Bleeping Computer — 2026-07-27