Certighost: New AD CS Exploit Lets Low-Privileged Users Impersonate Domain Controllers

What happened

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24, 2026, codenamed Certighost, that allows a low-privileged Active Directory user to obtain a certificate for a Domain Controller and use it to authenticate as that machine.

According to the report, because Domain Controller accounts hold directory replication rights, the resulting Kerberos credential can be used to perform a DCSync operation and retrieve the krbtgt secret — the key material used to forge Kerberos tickets domain-wide.

Why it matters

This is a privilege escalation path from a standard, low-privileged domain account to full domain compromise. Any organization running Active Directory Certificate Services (AD CS) with certificate templates or enrollment configurations that can be abused to impersonate machine accounts should treat this as a high-impact issue. Obtaining the krbtgt hash effectively enables persistent, domain-wide access via forged (golden) Kerberos tickets, making this attractive to both initial-access and post-compromise attackers.

What defenders should watch for now

• Review AD CS certificate templates and enrollment permissions for misconfigurations that allow low-privileged principals to request certificates usable for Domain Controller authentication.
• Monitor certificate issuance events (e.g., Certificate Services event logs) for certificates issued to or usable as machine/DC identities requested by non-admin accounts.
• Watch for anomalous authentication using DC machine identities from hosts or accounts that don't normally authenticate as a DC.
• Monitor for DCSync-style replication requests (directory replication service calls) originating from accounts or hosts other than legitimate Domain Controllers.
• Audit and tighten AD CS template permissions, following existing AD CS hardening guidance (e.g., disabling vulnerable enrollment options, restricting who can enroll for sensitive templates).

Developing story

This is net-new intelligence and full technical details, affected configurations, and vendor guidance may still be emerging. Defenders should treat the specifics above as high-level hunting angles pending further disclosure, and review the original report for the latest technical detail: The Hacker News: Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller.