This week, we briefed our clients on "Certighost", a Domain Controller Impersonation Exploit that allows standard users to obtain valid DC certificates.
KEY TAKEAWAYS
Domain Controller impersonation exploit identified allowing non-privileged users ability to impersonate a DC and capture krbtgt.
On Friday, July 24, researchers H0j3n and Aniq Fakhrul published a working exploit that allows a low-privilege Active Directory user to obtain a certificate for a Domain Controller (DC) and authenticate as that machine.
This flaw was initially discovered on May 14th and was reported to Microsoft, who confirmed the flaw on May 22nd. A patch was released on July 14th to reduce the risk of a successful exploit.
They named this exploit Certighost because Domain Controllers carry directory replication rights, resulting in the Kerberos credential being compromised. This standard user was able to create a computer account under the default ms-DS-MachineAccountQuota value of 10 or reuse one that it already controlled.
Exploitation requires network access and a standard user account – no administrator or elevated privileges required. A successful exploit also requires an Enterprise Certificate Authority (CA) that followed the vulnerable chain path, allowed enrollment through the default Machine template, and network reachability from the CA to the attacker's SMB and LDAP listeners.
A successful exploit begins with the attacker creating a machine account and promoting it to a Domain Controller. Using rogue LSA and LDAP services, the Certificate Authority authentication challenge could be supplied to a legitimate DC and the resulting response replayed to the CA. The Certificate Authority responded to the attacker-supplied cdc host over SMB and LDAP without first proving it was a legitimate Domain Controller.
The final public exploit automates this process, creating a computer account and replaying the CA challenges and responses over Netlogon using Public Key Cryptography for Initial Authentication in Kerberos (PKINIT). Once successful, the fake machine can request account secrets through DCSync, including krbtgt.
The patch supplied on July 14th adds a requirement to validate the certificate request before granting access. This requirement matches a specific AD object with DNS name and userAccountControl to include SERVER_TRUST_ACCOUNT (8192). A SID comparison further blocks substitution attempts.
How to Protect Your Organization
The primary way to protect your organization is to ensure the updates delivered on July 14th were successfully deployed to your organization.
If your organization cannot immediately patch, administrators can run the following string to clear the chase flag and restart Certificate Services:
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force
Resources
https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html
https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
Vulnerability Roundup
The Qilin Ransomware group has been observed exploiting a high-severity vulnerability in Palo Alto Networks PAN-OS. This vulnerability was identified in June and tracked as CVE-2026-0257. Administrators are asked to patch immediately.
CheckPoint Software has identified a new vulnerability tracked as CVE-2026-16232 that allows for authentication bypass within the CheckPoint GUI. This will allow attackers access to Security Management or Multi-Domain Security Management servers where security policy can be altered in favor of the attacker. This only applies to specific use cases where on-site Management Servers are exposed to remote access via the Internet. A PacketWatch search is available for additional monitoring.
\*.ip:(151.251.99.207 OR 151.241.99.233 OR 158.62.198.182 OR 192.142.10.99 OR 139.28.37.250)
A critical SharePoint RCE flaw has been observed actively exploited to steam machine keys and maintain persistence even after patching. Tracked as CVE-2026-50522, successful attacks have been identified as early as July 17th. Exploit proof of concept code has been released on GitHub that attempts to trigger remote code execution by delivering a malicious .NET ‘BinaryFormatter’ payload as the cookie of a forged ‘SecurityContextToken’ within a WS-Federation sign-in response.
Two recently identified SonicWall SMA1000 vulnerabilities have been actively exploited allowing attackers to install custom malware on vulnerable VPN appliances. These flaws are tracked as CVE-2026-15409 and CVE-2026-15410. SonicWall has released patches inversions 12.4.3-03453 and 12.5.0-02835.
Affected products include SonicWall SMA1000 Series models 6210, 7210, and 8200v running:
F5 has shipped fixes for a critical nginx flaw that would allow a remote, unauthorized attacker trigger a heap overflow in the worker process. Tracked as CVE-2026-42533, patches were released on July 15th. F5 indicates this buffer overflow flaw can crash or restart the worker leading to DoS or allow for RCE. This CVE is rated as a 9.1 but attack complexity is high. Every nginx version from 0.9.6 through 1.31.2 is vulnerable which dates back to 2011.
Security researchers have identified a vulnerability dubbed "HollowByte" that would allow unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers with a payload of just 11 bytes. This flaw has been fixed by OpenSSL with no CVE identifier being assigned. OpenSSL has fixed this issue in OpenSSL 4.0.1 and backported to versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21. Any OpenSSL packages in use should be upgraded immediately to remediate this flaw.
7-zip version 26.02 was released on June 25th to fix a RCE that could allow attackers to execute malicious code. Attackers would distribute specifically crafted compressed files and convince user to open these files triggering a heap-based buffer overflow allowing for the potential of arbitrary code execution on the victim’s computer as the user. Because 7-zip does not have an automatic update feature, administrators are encouraged to inform all users of 7-zip to manually update to the latest version.
Zoom has released security updates for a critical severity flaw impacting Zoom Workplace for Windows that could facilitate account takeover. Tracked as CVE-2026-53412, this vulnerability affects Zoom workplace for Windows before version 7.0.0 and Zoom Workplace VDI Client for Windows before version 7.0.10, 6.6.15, and 6.5.18 in their respective branches. This security update also fixes three additional high severity flaws – CVE-2026-53411, CVE-2026-53410, and CVE-2026-53409. CVE-2026-53410 also impacts the following products:
https://thehackernews.com/2026/07/zoom-patches-critical-windows-flaw-that.html
https://thecyberexpress.com/cve-2026-53412-zoom-desktop-client/
Tuesday, July 14th, Microsoft released its largest Patch Tuesday on record, including two flaws under active exploitation. This release addressed 622 Microsoft CVE’s which easily tops the previous record of around 200 in June.
The following vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog in the last 2 weeks:
This report is provided FREE to the cybersecurity community.
Visit our Cyber Threat Intelligence Blog for additional reports.
Visit our Cyber Threat Profile Blog for detailed intelligence profiles.
Visit our Beyond the Threat Feed Blog for more articles.
Subscribe to be notified of future Reports:
NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.