Certighost Exploit Enables Domain Controller Impersonation via AD Certificate Services
Written by AI from the linked story. Not reviewed by an editor. How this works
The Certighost exploit (CVE-2026-54121) exposes a critical flaw in Active Directory Certificate Services (AD CS) that allows any low-privileged domain user to obtain a Domain Controller certificate and perform DCSync attacks, ultimately retrieving the krbtgt secret. This is particularly dangerous because it requires no administrator privileges, no user interaction, and only basic network access — dramatically lowering the bar for full domain compromise. Once an attacker possesses the krbtgt hash, they can forge Golden Tickets and maintain persistent, undetected access across the entire domain. This attack class highlights how misconfigured or unpatched PKI infrastructure can silently undermine the entire security boundary of an Active Directory environment.
Tactical Insight
Immediate actions
- Apply Microsoft's patch for CVE-2026-54121 to all domain controllers and AD CS servers immediately.
- Audit AD CS certificate templates to ensure no template grants low-privileged users the ability to enroll for Domain Controller or machine authentication certificates.
- Restrict network access to AD CS enrollment endpoints to only authorized systems and administrators.
Long-term improvements
- Implement the principle of least privilege for all AD CS enrollment permissions, removing unnecessary enrollment rights from default domain users.
- Regularly review and harden AD CS configurations using tools such as Locksmith or PSPKIAudit to detect dangerous template misconfigurations.
- Segment AD CS infrastructure from general-purpose network zones to limit lateral movement opportunities.
Detection measures
- Monitor for unusual certificate enrollment events (Event IDs 4886, 4887) involving non-administrative accounts requesting Domain Controller authentication certificates.
- Alert on unexpected DCSync activity (replication requests from non-DC accounts) using SIEM rules targeting Event ID 4662 with replication permissions.
- Deploy honeypot Domain Controller accounts to detect Golden Ticket and DCSync abuse patterns in near real-time.