'Certighost' Flaw Haunts Microsoft Active Directory Certificates

A proof-of-concept (PoC) exploit has been released for a critical vulnerability in Microsoft's Active Directory Certificate Services (AD CS), tracked as CVE-2026-54121. The flaw, dubbed 'Certighost,' enables a low-privileged domain user to impersonate a domain controller and fully compromise an Active Directory environment. Researchers demonstrated how attackers can manipulate certificate enrollment processes to trick the CA into trusting malicious hosts. Microsoft addressed the issue in its July Patch Tuesday updates. Organizations are urged to apply the patch immediately to prevent potential exploitation.