Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.

The article reports on Certighost (CVE-2026-54121), an elevation-of-privilege flaw in Active Directory Certificate Services that lets any low-privileged domain user obtain a certificate for a Domain Controller, authenticate as that DC, and then retrieve the krbtgt secret via DCSync for full domain compromise.[1][3][5][6] Microsoft has shipped a patch, but a fully working public exploit is now available, making exploitation accessible to attackers with only standard domain accounts.[1][3][4][6] From a RealGround perspective, this is primarily an identity and infrastructure vulnerability that can indirectly impact AI systems by compromising the underlying Windows domains, PKI, and credentials that AI platforms depend on. Organizations should treat AD CS and Domain Controllers as critical components of the AI supply chain, ensure rapid patching and hardening, and include Certighost-style identity layer failures in SBOM and dependency risk assessments for any AI services tied into the affected Windows environments.