Microsoft Fixes Certighost Flaw That Allowed Domain Controller Impersonation

The Certighost vulnerability (CVE-2026-54121) exposes a fundamental weakness in Active Directory Certificate Services, where insufficient validation of identity data allowed a low-privilege user to obtain a certificate impersonating a Domain Controller. This matters because certificate-based trust is foundational to Active Directory security — once an attacker holds a DC certificate, they can execute DCSync attacks to extract credential hashes for every account in the domain, achieving full domain compromise. The root issue lies in the Certification Authority's failure to enforce strict controls over attacker-controllable identity attributes during certificate enrollment. This class of AD CS vulnerability (similar to ESC family attacks) has become a prime target for ransomware operators and nation-state actors due to its high impact and often-overlooked attack surface.