CertiGhost (CVE-2026-54121): a standard account can take over the whole Windows domain
by Claudiu Hulea · IT Management Consultant
CertiGhost (CVE-2026-54121) is a critical flaw in Active Directory Certificate Services (AD CS) that lets a low-privileged domain user, with no administrator account, obtain a certificate that authenticates as a domain controller — and from there take over the entire domain. A public PoC exploit is already out, so the urgency is real. Below: how it works and what to do.
In brief
- Vulnerability: CVE-2026-54121, in AD CS, an improper-authorization flaw (CVSS 8.8).
- Affected: Windows Server 2012 through 2025, including Server Core editions.
- Impact: an ordinary domain account can impersonate a domain controller and, via DCSync, extract the krbtgt account secret — that is, full domain takeover.
- Fix: patched in Microsoft’s 14 July 2026 updates (Patch Tuesday).
- Status: public PoC since 24 July 2026; no mass exploitation reported (yet), but the low barrier to entry makes it attractive to ransomware affiliates.
How it works
- Machine account — an ordinary user creates a machine account (allowed by default via
ms-DS-MachineAccountQuota). - Malicious certificate request — they submit a request with attributes that point to an attacker-controlled server (
cdc— client DC) and target a domain controller’s account (rmd); in parallel they run rogue SMB, LSA and LDAP services. - The CA “chases” without validation — in vulnerable versions, the certification authority (CA) connects to the attacker’s server and accepts a false domain-controller identity.
- Domain-controller certificate — the CA issues a certificate that allows authentication as the domain controller, via PKINIT.
- DCSync → full takeover — with that certificate, the attacker authenticates as the DC, gains replication rights and runs DCSync, extracting the krbtgt secret. With krbtgt, they can forge “golden tickets” and control the whole domain.
Why it’s serious
It needs no administrator and no exotic configuration: an ordinary domain account plus the default setting that lets users create machine accounts is enough. The end result — the krbtgt secret — means total, persistent control over the entire Active Directory.
What to do now
- Apply Microsoft’s July 2026 updates immediately. The fix adds validation of the “chase” target, so the CA checks that the attribute points to a legitimate domain controller. This is the real fix — a temporary workaround was described as insufficient.
- Reduce the surface: set
ms-DS-MachineAccountQuotato 0 (ordinary users shouldn’t be able to create machine accounts) and harden the AD CS configuration. - Monitor: unusual certificate requests to the CA, and especially replication (DCSync) initiated from sources that aren’t domain controllers — a classic domain-takeover signal.
The takeaway
AD CS is one of the most effective paths to taking over a Windows domain — a misconfiguration or a flaw like this turns any account into a domain admin. Patching discipline and AD CS hardening are essential, and a penetration test or an IT security audit is how you find such paths before an attacker does.
Sources
- BleepingComputer — New CertiGhost PoC exploit lets attackers hijack Windows domains
- Help Net Security — PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121)
- Microsoft security advisory for CVE-2026-54121 (July 2026 updates)
Frequently asked questions
What is CertiGhost (CVE-2026-54121)?
A critical improper-authorization flaw in Active Directory Certificate Services (AD CS) (CVSS 8.8) that lets a low-privileged domain user, with no administrator account, obtain a certificate that authenticates as a domain controller — and from there take over the whole domain. It affects Windows Server 2012 through 2025.
How does it lead to domain takeover?
An ordinary user creates a machine account and submits a malicious certificate request pointing to an attacker server; the vulnerable CA "chases" it without validation and issues a domain-controller certificate. With it, the attacker authenticates as the DC (PKINIT), gains replication rights and runs DCSync, extracting the krbtgt secret — total, persistent control.
How do I protect myself?
Apply Microsoft's July 2026 updates immediately (the fix validates the "chase" target; a temporary workaround was described as insufficient). Reduce the surface: set `ms-DS-MachineAccountQuota` to 0 and harden AD CS. Monitor unusual certificate requests and DCSync replication from sources that aren't domain controllers.
Is it actively exploited?
A public PoC exists since 24 July 2026; no mass exploitation is reported yet, but the low barrier to entry — an ordinary domain account — makes it attractive to ransomware affiliates, so the urgency is real.