New Certighost PoC exploit lets attackers hijack Windows domains

The Certighost vulnerability (CVE-2026-54121) exposes a critical flaw in Windows Active Directory Certificate Services (AD CS), allowing authenticated attackers to manipulate machine account attributes and obtain forged certificates to impersonate domain controllers. This effectively grants domain-level administrative privileges, meaning a single compromised account could lead to full enterprise takeover. The public release of a proof-of-concept exploit dramatically lowers the barrier for attackers, making unpatched systems an immediate target. Microsoft issued a patch in July 2026, but organizations that delay deployment remain at severe risk. AD CS misconfigurations and privilege escalation paths have become a recurring attack surface that demands proactive, continuous attention.