Certighost PoC Drops: AD CS Flaw Enables Domain Takeover
PoC for Certighost, a Windows AD Certificate Services flaw, is now public. Authenticated attackers can use it to hijack a Windows domain.
airgap Proof-of-concept exploit for “Certighost” is public. Windows Active Directory Certificate Services. Authenticated attackers — potential domain compromise. BleepingComputer reported the release on July 27.
What’s confirmed
Per available disclosures: the flaw resides in Windows Active Directory Certificate Services. An authenticated attacker can exploit it to potentially compromise a Windows domain. A PoC has been released publicly as of this writing.
No CVE identifier confirmed in available reporting at time of publication. CVSS score not available from current disclosures. Affected version ranges not specified in initial coverage — consult Microsoft’s Security Update Guide for patch status as it is published.
Why this class of flaw matters
Active Directory Certificate Services is the PKI layer that underpins Windows domain authentication — it issues and validates certificates used for Kerberos, smart card logon, and encrypted channel establishment. When AD CS misbehaves, the blast radius is the domain, not a single host or service. Certificates issued by a compromised CA can authenticate as any domain account, including privileged ones.
The authentication prerequisite creates a real barrier: an attacker needs valid credentials before this path opens. That’s not a sufficient barrier. A phished credential, data from a prior breach, or lateral movement from an already-compromised host all satisfy the requirement. In most enterprise environments, reaching an authenticated foothold is not the hard part of an intrusion — escalating to domain admin is. Certighost provides a path for that escalation.
PoC availability compresses the timeline for anyone who already has the authentication prerequisite.
Action items
- Check patch status now. Search Microsoft’s Security Update Guide for Certighost or the relevant AD CS component. If a patch is available, apply it before other scheduled work.
- Audit AD CS presence. The role deploys silently with many Windows Server configurations. If your team isn’t actively managing a PKI, it may still be running one. Confirm before assuming it’s not in scope.
- If prior compromise is suspected: review certificates issued by your CA before patching. Patching the flaw does not revoke certificates that were already issued under a compromised state.
Treat the authentication requirement as a filter on attacker population, not as protection against a determined one.
Found this useful? Share it.
