Windows Domain Hijacking Exploit Released, Warns of Significant Risks
A new proof-of-concept exploit has been released for a previously patched vulnerability in Windows Active Directory Certificate Services, allowing attackers to potentially hijack entire domains. The exploit, dubbed “Certighost,” can be used by authenticated users to manipulate domain controller accounts and gain domain-level administrative capabilities.
The vulnerability, tracked as CVE-2026-54121, was fixed by Microsoft as part of the July 2026 Patch Tuesday security updates. However, a group of security researchers, H0j3n and Aniq Fakhrul, have now publicly disclosed technical details regarding the vulnerability, including the release of an exploit that can be used to gain domain-level administrative capabilities.
The exploit takes advantage of a fallback mechanism used by Active Directory Certificate Services during certificate enrollment requests. This “chase” mechanism uses two certificate request values: cdc (Client DC) and rmd (Remote Domain). When both attributes are supplied, the Certification Authority connects to the server specified in the cdc value and searches for the specified rmd account. However, systems previously did not verify that the server supplied through the attacker-controlled cdc value was a legitimate domain controller.
This allowed an attacker to run rogue SMB, LSA, and LDAP services, direct the CA to the attacker-controlled system, and return false directory information for a targeted machine account. The researchers demonstrated this attack by creating a machine account, submitting a certificate request that directed the CA to the rogue services, and using the resulting certificate to authenticate as the targeted domain controller.
The released certighost.py proof-of-concept exploit automates this process, allowing attackers to easily hijack domains. The exploit uses the certificate to authenticate through PKINIT as the targeted domain controller, saving the resulting Kerberos credentials to a .ccache file and extracting the account’s NT hash.
For administrators who have not yet installed the July Patch Tuesday updates, this vulnerability poses a significant risk. An attacker with access to an authenticated user account can use the Certighost exploit to gain domain-level administrative capabilities, potentially leading to complete domain compromise.
Microsoft fixed the vulnerability by adding validation to the chase process, verifying that the server specified in the cdc attribute maps to a legitimate domain controller in Active Directory and confirming that the returned identity matches the expected account. Administrators are advised to install the July Patch Tuesday updates as soon as possible to prevent potential attacks.
Ultimately, this exploit serves as a reminder of the importance of keeping software up-to-date and patching vulnerabilities promptly. Even previously patched vulnerabilities can still pose significant risks if exploited by attackers with access to authenticated user accounts.
Source: Bleeping Computer — 2026-07-27