What Happened
On July 24, 2026, security researchers H0j3n and Aniq Fakhrul published a working proof-of-concept exploit for CVE-2026-54121, an Active Directory Certificate Services (AD CS) vulnerability they named Certighost. The flaw has a CVSS score of 8.8 and was patched by Microsoft as part of the July 14 Patch Tuesday update.
The attack works by exploiting an enrollment fallback behavior in AD CS called a “chase” during directory-object resolution. By supplying specific request attributes — including a cdc parameter — an attacker can cause the Certification Authority to request identity data from an attacker-controlled host and use it to issue a certificate for a Domain Controller account. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential allows the attacker to perform a DCSync operation and retrieve the krbtgt hash. With the krbtgt secret, an attacker can forge Kerberos tickets for any account in the domain, including Enterprise Admins — effectively achieving full Active Directory compromise from a standard user account. Exploitation requires only network access and a valid domain account. No administrator rights and no user interaction are needed.
The public release of a reliable working exploit immediately elevates the real-world risk. Organizations with unpatched AD CS instances face the possibility of silent domain takeover by any authenticated attacker, whether internal or external.
Why This Matters for Canadian Organizations
Active Directory is the backbone of identity and access management across the vast majority of Canadian enterprise and government environments. AD CS, the certificate authority component targeted by Certighost, is widely deployed to support smart card authentication, VPN certificate issuance, and device enrollment across federal departments, provincial governments, hospitals, financial institutions, and universities.
A successful Certighost attack gives an attacker the equivalent of domain administrator access from a low-privilege starting point. In a Canadian government or healthcare context, this translates to unrestricted access to file shares, email systems, HR data, and any other resource integrated with Active Directory — all of which fall under PIPEDA and sector-specific frameworks including OSFI Guideline B-13. The July 14 patch has been available for ten days; organizations that have not applied it are at material risk. With a public exploit now circulating, threat actors have a reliable recipe and the window to patch before active exploitation begins is narrow.
What to Do
Apply the July 2026 Patch Tuesday update (MS26-07) immediately on all AD CS servers. Prioritize Certificate Authority servers and Domain Controllers. Review your AD CS enrollment policies for unusual certificate request patterns — look for certificate requests using the cdc attribute or unusual subject alternative names for machine accounts. Use tools such as Certipy or the AD CS Attack Paths module in BloodHound to audit your AD CS configuration for additional ESC misconfigurations. Restrict network access to CA enrollment endpoints to authorized hosts only. If you observe DCSync activity or unexpected Domain Controller authentication events, treat them as potential Certighost exploitation and initiate incident response. Organizations subject to OSFI B-13 should determine whether the patch exposure period constitutes a reportable incident.
Source: The Hacker News
