Certighost exploit lets attackers impersonate domain controllers

Researchers H0j3n and Aniq Fakhrul released a proof-of-concept exploit for CVE-2026-54121, a Windows Active Directory Certificate Services vulnerability. The flaw allows a low-privileged domain user to impersonate a Domain Controller and compromise the domain. Microsoft patched the issue in July 2026.