Certighost Active Directory CS Exploit Allows Low-Privileged Users to Compromise Domain

A critical AD CS vulnerability dubbed Certighost (CVE-2026-54121) allowed low-privilege users to supply rogue chase targets during certificate enrollment so the CA issued certificates impersonating Domain Controllers; attackers could then authenticate as DCs and perform DCSync to obtain krbtgt and take over an Active Directory domain. Microsoft patched the flaw in July 2026 and recommends immediate patching and auditing or disabling the chase fallback (EDITF_ENABLECHASECLIENTDC) until updates are applied.