GoKawiilA proof-of-concept exploit for “Certighost,” a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain.
Tracked as CVE-2026-54121, the vulnerability was fixed by Microsoft as part of the July 2026 Patch Tuesday security updates.
"An authenticated attacker could manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via PKINIT," Microsoft explained.
If the attacker can target a domain controller account, Microsoft says they could authenticate as the domain controller and perform privileged Active Directory operations.
Security researchers H0j3n and Aniq Fakhrul reported the vulnerability to Microsoft on May 14, 2026, with Microsoft fixing the flaw in the July security updates.
Last week, the researchers publicly disclosed the technical details regarding the vulnerability, including the release of an exploit that can be used to gain domain-level administrative capabilities.
"Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration," reads the researchers' technical writeup.
Abusing the AD CS chase mechanism
Active Directory Certificate Services (AD CS) is Microsoft's public key infrastructure for Windows domains and is used to issue certificates for authentication and secure communications.
During certificate-based authentication, the domain controller verifies which Active Directory account the certificate belongs to and then issues Kerberos credentials.
... continue reading