Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user request a certificate binding to a Domain Controller's identity, then authenticate as that machine against any service that trusts the certificate authority. The technique, dubbed CertiGhost, does not require compromising an existing DC or planting malware. It abuses certificate template logic that Active Directory Certificate Services has shipped by default for years, the same enrollment surface that produced the ESC1 through ESC8 escalation paths documented since 2021.

The fix is template-level, not patch-level. There is no CVE tied to this release because the behavior is Windows working as configured, and Microsoft's guidance since the original PKI escalation research has been to audit template permissions rather than wait for a security update. Any AD administrator who has not run PSPKIAudit or Certipy against their certificate authority since ESC8 became public should treat July 24 as the day that gap stopped being theoretical. The control that closes it is enrollment restriction on Domain Controller templates, not a patch Tuesday entry.