[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqYdi3-6ogOz3hkDmB46Cse-qzpd-YLNETtGOq-Yolew":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f3bb9fd4-4f1e-426d-a713-4b32ec3674c6","Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller","certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-doma-283f9b","Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.","Researchers have released a working exploit called Certighost that allows low-privileged Active Directory users to impersonate a Domain Controller. This vulnerability, patched by Microsoft as CVE-2026-54121, enables attackers to obtain a Domain Controller certificate and then use DCSync to retrieve the krbtgt secret. Exploitation requires network access and a domain account but no administrator privileges or user interaction.","Certighost exploit allows low-privileged AD users to impersonate Domain Controllers.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fcertighost-exploit-lets-low-privileged.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjdJCaF3dwhncVhtS_dn9W8CUCwJSHRmtCVTK5_fXnS6RpDI4GaVTcSVoXvmo_JgxUyd-H5G3yQaRAg3Ahp__DMlq-M5r9ejhJTdk5QlVuv16HVXDWV7e3HJAijAVBRumD3XSyeyQ1O477nfXFfTvCwgFeXlYF8QIdfTN4mlYAu28JGFN7lOWTEoKwlG9g\u002Fs1600\u002Fcertighost.jpg","2026-07-24T14:15:21+00:00","2026-07-24T16:00:16.731955+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"Active Directory","technology",{"name":21,"type":19},"Active Directory Certificate Services",{"name":23,"type":24},"Windows Server","product",{"name":26,"type":19},"Kerberos",{"name":28,"type":19},"DCSync",{"name":30,"type":31},"Microsoft","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-54121","Improper authorization vulnerability in Active Directory Certificate Services (AD CS).",[30,23],{"controls":62,"vendors":144},[63,91,118],{"slug":64,"name":65,"problem":66,"products":67},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[68,75,83],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":64,"product_name":72,"url":73,"description":74},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,103,111],{"vendor_slug":97,"vendor_name":30,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":92,"product_name":115,"url":116,"description":117},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":119,"name":120,"problem":121,"products":122},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[123,128,136],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":124,"product_name":125,"url":126,"description":127},"zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[145],{"slug":97,"name":30,"logo_path":98,"roles":146},[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":164},"certighost-exploit-enables-domain-controller-impersonation-via-ad-certificate-services","Certighost Exploit Enables Domain Controller Impersonation via AD Certificate Services","The Certighost exploit (CVE-2026-54121) exposes a critical flaw in Active Directory Certificate Services (AD CS) that allows any low-privileged domain user to obtain a Domain Controller certificate and perform DCSync attacks, ultimately retrieving the krbtgt secret. This is particularly dangerous because it requires no administrator privileges, no user interaction, and only basic network access — dramatically lowering the bar for full domain compromise. Once an attacker possesses the krbtgt hash, they can forge Golden Tickets and maintain persistent, undetected access across the entire domain. This attack class highlights how misconfigured or unpatched PKI infrastructure can silently undermine the entire security boundary of an Active Directory environment.",[153,154,155,156,157,158,159,160,161,162,163],"CIS Control 7: Continuous Vulnerability Management","CIS Control 5: Account Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1649: Steal or Forge Authentication Certificates","MITRE ATT&CK T1003.006: DCSync","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","ITIL Change Management: Emergency Change Procedures",{}]