Kudelski Security Research Center

Certighost (CVE-2026-54121) is a critical AD CS vulnerability that lets a low‑privileged domain user manipulate the chase fallback process to obtain certificates impersonating a Domain Controller, enabling full domain compromise (e.g., DCSync). Microsoft released a July 2026 security update to validate chase targets; mitigations include applying the patch, disabling chase fallback, and restricting certificate template permissions. A public PoC exists and the issue should be treated as actively exploited.