Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

Researchers disclosed 'Certighost' (CVE-2026-54121), an AD CS enrollment fallback (chase) authorization flaw that allows a low-privileged domain user to obtain a Domain Controller certificate and authenticate as that DC via PKINIT — enabling DCSync and theft of the krbtgt secret; Microsoft patched AD CS on July 14 and a public proof-of-concept was released on July 24, with mitigation guidance provided (apply updates or disable chase as a temporary measure).