Any employee's login can now become domain admin — and the exploit code is already public

On July 24, security researchers published a working exploit for CVE-2026-54121 — a flaw they've nicknamed Certighost — that lets any authenticated domain user, with no admin rights at all, forge a certificate that lets them impersonate a Windows Domain Controller. From there, an attacker can extract the krbtgt secret, the master key underpinning every Kerberos ticket in the domain, and effectively own the whole network. Microsoft patched the underlying bug in Active Directory Certificate Services on July 14. If your organization hasn't applied that update, this is the one to check before reading any further.

How Certighost actually works

The bug lives in a fallback mechanism AD CS uses during directory-object resolution, which researchers call a 'chase,' as detailed to Help Net Security. By default, Active Directory lets any domain user create a limited number of machine accounts — a setting called ms-DS-MachineAccountQuota, and most organizations never change the default of 10. An attacker uses that quota to create a machine account, then requests a certificate while supplying crafted attributes that cause the Certificate Authority to reach out to an attacker-controlled host for identity data. Because the attacker controls that host — running rogue SMB, LSA and LDAP services to answer the CA's query — they can feed it the identity of a real Domain Controller. The CA issues a certificate binding that stolen identity to the attacker's machine account, and that certificate authenticates via PKINIT as if it were the actual DC.

Why this one deserves more attention than a routine AD CS bug

AD CS bugs aren't rare — Patch Tuesday alone shipped 569 fixes in July, and Windows infrastructure has had a brutal few months: a zero-day in AD FS exploited for privilege escalation, a wave of SharePoint RCEs under active attack, and a critical Windows Server network driver flaw that needs nothing but network access. What sets Certighost apart is the privilege floor. Most domain-takeover chains still require some initial foothold with elevated rights, or a chain of smaller bugs strung together. This one starts from the credentials of literally any employee — the account that logs into email and the shared drive is enough — and ends at the keys to Kerberos itself, per BleepingComputer's writeup.

What to do right now

Here's the priority list researchers and Microsoft recommend, cross-checked against the published PoC writeup:

Patch first, audit second — in that order, since the registry workaround is a stopgap researchers themselves don't trust as a real fix. If your organization runs AD CS anywhere and you haven't confirmed the July update landed, that's this week's actual priority, not next sprint's.