Somewhere in every horror movie, someone realizes the call is coming from inside the house. In Active Directory land, the equivalent nightmare just got a name, a logo-worthy title, and a working proof-of-concept: your lowest-privileged intern account can now impersonate the actual Domain Controller. No admin rights required. No user interaction needed. The house was never locked to begin with.

A Forged ID Card That Fools the Bouncer

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 for a flaw they've dubbed Certighost, tracked as CVE-2026-54121 in Microsoft's Active Directory Certificate Services. The bug lives in an enrollment fallback mechanism — a "chase" — where the certificate authority blindly follows a requester-supplied host over SMB and LDAP without ever confirming it's actually talking to a real Domain Controller.

That means a standard domain user, with zero elevated permissions, can trick the CA into issuing a certificate that authenticates as a Domain Controller via Kerberos PKINIT. From there it's a short hop to a DCSync attack and the krbtgt secret — the master key that can forge access to essentially anything in the domain. Microsoft shipped a fix on July 14, rated 8.8 in severity; the public exploit landed ten days later.

The Ten-Day Window Nobody Wanted

Here's the uncomfortable part: patches don't install themselves the moment Patch Tuesday lands. Plenty of AD CS deployments run in environments where "we'll get to it next maintenance window" is standard operating procedure, and now there's a public, working exploit sitting out in the open for anyone to try against them.

What makes Certighost nastier than your average CVE isn't just the blast radius — full domain compromise is always a bad day — it's the low bar for entry. No phishing, no social engineering, no zero-click browser chain to build. Just network access and any old domain account, the kind practically everyone in a large org already has.

If your org runs AD CS and you haven't personally confirmed the July patch is installed everywhere — not just scheduled — today's the day to go check, not next sprint.

Got a Drupal site (or one that should be)? Let's chat.

Source: The Hacker News