← Back to Feed
Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
CVE-2026-54121
July 24, 2026 · The Hacker News · Severity: HIGH
Researchers published a working exploit called Certighost (CVE-2026-54121, CVSS 8.8) that lets low-privileged Active Directory users obtain a certificate for a Domain Controller and authenticate as that machine. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync. Microsoft patched the AD CS issue ten days before the exploit went public. Exploitation requires network access, a domain account, and specific CA configuration conditions.
Key Takeaways
- Certighost exploit (CVE-2026-54121, CVSS 8.8) lets low-privileged AD users impersonate a Domain Controller.
- The exploit chains AD CS certificate enrollment with DCSync to retrieve the krbtgt secret for domain-wide compromise.
- Exploitation needs: domain account, network access, vulnerable Enterprise CA with Machine template, and SMB/LDAP reachability.