Microsoft Fixes Certighost Flaw That Allowed Domain Controller Impersonation

**Certighost (CVE-2026-54121)**: A high-severity AD CS vulnerability allowed attacker-controlled directory responses during the CA "chase" process to be accepted as proof of identity, enabling issuance of valid certificates impersonating Domain Controllers; a PoC demonstrated obtaining Kerberos credentials and performing DCSync leading to potential full domain compromise, Microsoft patched the issue on July 14, 2026 and published mitigations.