New Certighost PoC exploit lets attackers hijack Windows domains

Certighost (CVE-2026-54121) is an AD CS vulnerability allowing an authenticated low-privileged user to abuse the AD CS "chase" fallback to obtain a certificate for a targeted Domain Controller, authenticate via PKINIT, extract Kerberos credentials and perform DCSync to retrieve sensitive account secrets; Microsoft patched the issue in July 2026 and researchers have published a proof-of-concept exploit (certighost.py), with a temporary mitigation available.