Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

The Certighost exploit (CVE-2026-54121) exposes a critical flaw in Active Directory Certificate Services (AD CS) that allows any low-privileged domain user to obtain a Domain Controller certificate and perform DCSync attacks, ultimately retrieving the krbtgt secret. This is particularly dangerous because it requires no administrator privileges, no user interaction, and only basic network access — dramatically lowering the bar for full domain compromise. Once an attacker possesses the krbtgt hash, they can forge Golden Tickets and maintain persistent, undetected access across the entire domain. This attack class highlights how misconfigured or unpatched PKI infrastructure can silently undermine the entire security boundary of an Active Directory environment.