A dangerous privilege escalation bug in Microsoft’s certificate infrastructure now has a working exploit in the wild, giving attackers who already have a domain account a path straight to full Domain Controller privileges.
The vulnerability tracked as CVE-2026-54121 and nicknamed Certighost lives inside Active Directory Certificate Services, the component that manages an organization’s Public Key Infrastructure. Microsoft rated it 8.8 on the CVSS scale and shipped a patch on July 14.
Two researchers, Aniq Fakhrul and Muhammad Ali, found the flaw in May and have now published their full proof-of-concept code alongside a technical deep-dive. The attack exploits a fallback mechanism in the CA enrollment process. By supplying two custom attributes in a certificate request, an attacker can redirect the CA to an adversary-controlled host for identity resolution. The CA opens SMB and LDAP connections to that rogue host and blindly trusts the identity data it receives back.
From there the damage cascades fast. The forged certificate authenticates the attacker as a Domain Controller, which unlocks the directory replication capability known as DCSync. This lets them siphon the krbtgt password hash, the master key for all Kerberos tickets in the domain. With that single secret, they mint golden tickets for any account they choose. A foothold as a standard domain user escalates into total network compromise in a few commands.
Microsoft’s July update closes the hole by validating the CA’s directory lookup target before allowing any cross-host chase. Organizations that cannot patch immediately can disable the vulnerable fallback code path through a certutil registry change followed by a Certificate Service restart. No active exploitation in the wild has been reported so far.
