Certighost lets any domain user impersonate a domain controller and seize the domain

Researchers published a working exploit on July 24 for Certighost, an Active Directory Certificate Services flaw that lets a low-privileged domain user obtain a certificate for a domain controller and authenticate as that machine. Because domain controller accounts hold directory replication rights, the resulting credential can extract the krbtgt secret through DCSync, effectively handing over the whole domain. Microsoft patched it in the July 14 updates as CVE-2026-54121, an improper authorization issue scored 8.8. Exploitation needs only network access and an ordinary domain account, with no administrator rights or user interaction, and it was tested against a default enterprise certificate authority setup.

Check

Apply the July Microsoft updates to enterprise certificate authorities, and where immediate patching is not possible, disable the vulnerable chase fallback per Microsoft's guidance and restart the certificate service.

Affected

Active Directory environments running an unpatched Enterprise Certification Authority (CVE-2026-54121); any standard domain account can impersonate a domain controller, run DCSync, and take full control of the domain.

Fix

Deploy the July fix, audit certificate authority enrollment and issuance logs for domain controller impersonation, restrict machine account creation, and monitor for unexpected DCSync replication activity.