Certighost PoC Released: AD CS Vulnerability Enables Domain Compromise

A public proof-of-concept exploit has been released for "Certighost," a vulnerability in Windows Active Directory Certificate Services (AD CS), according to a report from BleepingComputer. The PoC reportedly allows an authenticated attacker to potentially compromise an entire Windows domain. Specific technical details on the exploitation chain, affected AD CS configurations, and whether a CVE identifier or vendor patch exists were not included in the available reporting.

Why It Matters

AD CS is a common target in Active Directory environments because certificate templates and enrollment services, when misconfigured, can be abused for privilege escalation and domain takeover — a well-documented risk category (e.g., the ESC1-ESC8 family of AD CS misconfigurations). A working PoC lowers the bar for attackers who already hold a foothold with valid domain credentials, since the exploit reportedly requires authentication rather than remote unauthenticated access. Organizations running on-premises AD CS deployments, particularly those with enterprise certificate authorities tied to Active Directory, should treat this as a near-term risk to prioritize for investigation.

What Defenders Should Do Now

• Inventory all AD CS certificate authorities and enrolled templates; identify which are internet- or broadly user-facing.
• Review certificate template permissions and enrollment rights for overly permissive configurations consistent with known AD CS misconfiguration classes.
• Monitor certificate issuance and enrollment logs for anomalous requests, especially from unexpected accounts or unusual template usage.
• Watch for follow-on authentication activity (e.g., Kerberos ticket abuse, NTLM relay) that could indicate a certificate obtained via this technique is being used for domain authentication.
• Ensure AD CS servers and CA hosts are patched and hardened per current Microsoft guidance, and follow vendor advisories closely as more details emerge.

This is developing intel based on a single news report, and full technical details, affected versions, and any official patch guidance were not available at time of writing. df00tech will publish a dedicated detection if and when further technical specifics (CVE, exploitation mechanics) are confirmed. Read the original report at BleepingComputer.