Cyber Threat Intelligence Report

This week, we briefed our clients on "Certighost", a Domain Controller Impersonation Exploit that allows standard users to obtain valid DC certificates.

 KEY TAKEAWAYS 

• Domain Controller impersonation exploit identified allowing non-privileged users ability to impersonate a DC and capture krbtgt.

• Critical and high severity vulnerabilities in PAN-OS, CheckPoint, SharePoint, SonicWall, nginx, OpenSSL, 7-zip, Zoom, and Microsoft plus updates to CISA KEV, patch now!

Domain Controller Impersonation Exploit identified - Certighost

On Friday, July 24, researchers H0j3n and Aniq Fakhrul published a working exploit that allows a low-privilege Active Directory user to obtain a certificate for a Domain Controller (DC) and authenticate as that machine.

This flaw was initially discovered on May 14th and was reported to Microsoft, who confirmed the flaw on May 22nd.  A patch was released on July 14th to reduce the risk of a successful exploit.

They named this exploit Certighost because Domain Controllers carry directory replication rights, resulting in the Kerberos credential being compromised.  This standard user was able to create a computer account under the default ms-DS-MachineAccountQuota value of 10 or reuse one that it already controlled.

Exploitation requires network access and a standard user account – no administrator or elevated privileges required.  A successful exploit also requires an Enterprise Certificate Authority (CA) that followed the vulnerable chain path, allowed enrollment through the default Machine template, and network reachability from the CA to the attacker's SMB and LDAP listeners.

A successful exploit begins with the attacker creating a machine account and promoting it to a Domain Controller.  Using rogue LSA and LDAP services, the Certificate Authority authentication challenge could be supplied to a legitimate DC and the resulting response replayed to the CA.  The Certificate Authority responded to the attacker-supplied cdc host over SMB and LDAP without first proving it was a legitimate Domain Controller.

The final public exploit automates this process, creating a computer account and replaying the CA challenges and responses over Netlogon using Public Key Cryptography for Initial Authentication in Kerberos (PKINIT).  Once successful, the fake machine can request account secrets through DCSync, including krbtgt.

The patch supplied on July 14th adds a requirement to validate the certificate request before granting access.  This requirement matches a specific AD object with DNS name and userAccountControl to include SERVER_TRUST_ACCOUNT (8192).  A SID comparison further blocks substitution attempts.

How to Protect Your Organization

The primary way to protect your organization is to ensure the updates delivered on July 14th were successfully deployed to your organization.

If your organization cannot immediately patch, administrators can run the following string to clear the chase flag and restart Certificate Services:

certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC

Restart-Service CertSvc -Force

Resources

• https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html

   

• https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

   

Vulnerability Roundup

Pan-OS Authentication Bypass actively exploited

The Qilin Ransomware group has been observed exploiting a high-severity vulnerability in Palo Alto Networks PAN-OS. This vulnerability was identified in June and tracked as CVE-2026-0257. Administrators are asked to patch immediately.

• https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html

• https://security.paloaltonetworks.com/CVE-2026-0257

CheckPoint warns of new SmartConsole zero-day exploit

CheckPoint Software has identified a new vulnerability tracked as CVE-2026-16232 that allows for authentication bypass within the CheckPoint GUI. This will allow attackers access to Security Management or Multi-Domain Security Management servers where security policy can be altered in favor of the attacker. This only applies to specific use cases where on-site Management Servers are exposed to remote access via the Internet. A PacketWatch search is available for additional monitoring.

\*.ip:(151.251.99.207 OR 151.241.99.233 OR 158.62.198.182 OR 192.142.10.99 OR 139.28.37.250)

• https://www.bleepingcomputer.com/news/security/check-point-patches-smartconsole-zero-day-exploited-in-attacks/

• https://support.checkpoint.com/results/sk/sk185169/

Critical SharePoint RCE flaw exploited

A critical SharePoint RCE flaw has been observed actively exploited to steam machine keys and maintain persistence even after patching. Tracked as CVE-2026-50522, successful attacks have been identified as early as July 17^th. Exploit proof of concept code has been released on GitHub that attempts to trigger remote code execution by delivering a malicious .NET ‘BinaryFormatter’ payload as the cookie of a forged ‘SecurityContextToken’ within a WS-Federation sign-in response.

• https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/

• https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522

SonicWall SMA1000 flaws exploited

Two recently identified SonicWall SMA1000 vulnerabilities have been actively exploited allowing attackers to install custom malware on vulnerable VPN appliances. These flaws are tracked as CVE-2026-15409 and CVE-2026-15410. SonicWall has released patches inversions 12.4.3-03453 and 12.5.0-02835.

Affected products include SonicWall SMA1000 Series models 6210, 7210, and 8200v running:

• 12.4.3-03245
• 12.4.3-03387
• 12.4.3-03434 (platform-hotfix)
• 12.5.0-02283
• 12.5.0-02624
• 12.5.0-02800 (platform-hotfix)

• https://www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/

   

• https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/

Another NGINX Vulnerability identified

F5 has shipped fixes for a critical nginx flaw that would allow a remote, unauthorized attacker trigger a heap overflow in the worker process. Tracked as CVE-2026-42533, patches were released on July 15^th. F5 indicates this buffer overflow flaw can crash or restart the worker leading to DoS or allow for RCE. This CVE is rated as a 9.1 but attack complexity is high. Every nginx version from 0.9.6 through 1.31.2 is vulnerable which dates back to 2011.

• https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html

• https://cyberstan.co.uk/nginx-rce/

DDoS vulnerability in OpenSSL

Security researchers have identified a vulnerability dubbed "HollowByte" that would allow unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers with a payload of just 11 bytes. This flaw has been fixed by OpenSSL with no CVE identifier being assigned. OpenSSL has fixed this issue in OpenSSL 4.0.1 and backported to versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21. Any OpenSSL packages in use should be upgraded immediately to remediate this flaw.

• https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/

• https://sec.okta.com/articles/2026/06/openssl-hollowbtye-a-dos-hiding-in-11-bytes/

7-zip RCE vulnerability identified

7-zip version 26.02 was released on June 25^th to fix a RCE that could allow attackers to execute malicious code. Attackers would distribute specifically crafted compressed files and convince user to open these files triggering a heap-based buffer overflow allowing for the potential of arbitrary code execution on the victim’s computer as the user. Because 7-zip does not have an automatic update feature, administrators are encouraged to inform all users of 7-zip to manually update to the latest version.

• https://www.bleepingcomputer.com/news/security/update-now-7-zip-fixes-rce-flaw-exploitable-with-malicious-archives/

• https://www.7-zip.org/ 

Zoom Workplace Critical Windows Flaw

Zoom has released security updates for a critical severity flaw impacting Zoom Workplace for Windows that could facilitate account takeover. Tracked as CVE-2026-53412, this vulnerability affects Zoom workplace for Windows before version 7.0.0 and Zoom Workplace VDI Client for Windows before version 7.0.10, 6.6.15, and 6.5.18 in their respective branches. This security update also fixes three additional high severity flaws – CVE-2026-53411, CVE-2026-53410, and CVE-2026-53409. CVE-2026-53410 also impacts the following products:

• Zoom Workplace for Windows before version 7.0.5
• Zoom Workplace VDI Client for Windows before 6.5.17 and 6.6.14 in their respective branch
• Zoom Workplace VDI plugin for Windows before 6.5.17 and 6.6.14 in their respective branch
• Zoom Rooms for Windows before 7.0.5
• Remote Control for Zoom Contact Center for Windows before version 7.0.0

• https://thehackernews.com/2026/07/zoom-patches-critical-windows-flaw-that.html

• https://thecyberexpress.com/cve-2026-53412-zoom-desktop-client/ 

Microsoft Patch Tuesday patches a record number of flaws

Tuesday, July 14^th, Microsoft released its largest Patch Tuesday on record, including two flaws under active exploitation. This release addressed 622 Microsoft CVE’s which easily tops the previous record of around 200 in June.

• https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html

CISA KEV Additions

The following vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog in the last 2 weeks:

• CVE-2026-50522 - Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
• CVE-2026-16232 -Check Point SmartConsole Improper Authentication Vulnerability
• CVE-2021-27137 - DD-WRT Stack-Based Buffer Overflow Vulnerability
• CVE-2026-0770 - LangFlow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
• CVE-2026-63030 - WordPress Core Interpretation Conflict Vulnerability
• CVE-2026-60137 - WordPress Core SQL Injection Vulnerability
• CVE-2026-39808 – Fortinet FortiSandbox OS Command Injection Vulnerability
• CVE-2026-25089 – Fortinet FortiSandbox OS Command Injection Vulnerability
• CVE-2026-58644 – Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
• CVE-2023-4346 – KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
• CVE-2026-46817 – Oracle E-Business Suite Improper Privilege Management Vulnerability
• CVE-2026-15410 – SonicWall SMA1000 Appliances Code Injection Vulnerability
• CVE-2026-15409 – SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
• CVE-2026-56164 – Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
• CVE-2026-56155 – Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
• CVE-2008-4128 – Cisco IOS Cross-Site Request Forgery Vulnerability

This report is provided FREE to the cybersecurity community.

Visit our Cyber Threat Intelligence Blog for additional reports.

Visit our Cyber Threat Profile Blog for detailed intelligence profiles.

Visit our Beyond the Threat Feed Blog for more articles.

Subscribe to be notified of future Reports:

NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.