Certighost CVE-2026-54121: Low-Privilege Users Impersonate a DC via AD CS

Certighost CVE-2026-54121: Low-Privilege Users Impersonate a DC via AD CS 1. Basic Information Article Title : New Certighost PoC exploit lets attackers hijack Windows domains Source : BleepingComputer Published Date : 2026-07-27 Original Article : https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/ Primary Source : https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 Related Entities : CVE-2026-54121, Certighost, Microsoft AD CS, Enterprise CA, PKINIT, Kerberos, DCSync, Impacket Severity : High 2. One-Sentence Summary A public PoC allows a low-privilege domain user to point AD CS "chase" references to an attacker host, trick the CA into trusting fake LDAP/LSA responses to get a Domain Controller certificate, and then take over the entire domain using PKINIT and DCSync. 3. Attack Flow An attacker connects to LDAP with a low-privilege domain account and lists CAs, DCs, and Domain SIDs/GUIDs. The attacker uses the default ms-DS-MachineAccountQuota=10 setting to create a computer account and register an SPN. The attacker starts fake LDAP and LSA services on their host. The attacker specifies their host in the certificate request's cdc (Client DC) field and the target DC in the rmd (Remote Domain) field. The CA connects to the attacker-specified cdc via SMB/LDAP to chase the reference. The attacker's service relays the CA's authentication challenge to the real DC and returns the target DC's objectSid and dNSHostName . The vulnerable CA treats the returned data as authoritative and issues a certificate containing the target DC's SID and DNS name. The attacker uses PKINIT to get a Kerberos TGT as the DC and saves it to a .ccache file. The attacker performs a DCSync using the DC account's replication rights to steal secrets, including krbtgt . 4. Attacker Position and Execution Location The attacker needs a host inside the domain with valid authentication that can reach the CA, DC, and SMB/LDAP ports. T