Certighost and the Privilege Hiding in Your Certificate Authority

Certighost (CVE-2026-54121) exploits a critical flaw in Microsoft Active Directory Certificate Services (AD CS), allowing any low-privileged domain user to obtain a certificate that impersonates a Domain Controller. By leveraging the PKINIT authentication protocol, an attacker can then authenticate as the Domain Controller itself, achieving full domain compromise with minimal initial access. This attack highlights the dangerous trust placed in PKI infrastructure — when the certificate authority is misconfigured or unpatched, it becomes the master key to the entire domain. The severity is compounded by how widely AD CS is deployed and how quietly it operates, often without robust monitoring. Microsoft has released a patch, making rapid deployment essential for every affected organization.