Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
Summary: Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24, codenamed Certighost, that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine, then use the resulting Kerberos credential to pull the krbtgt secret through DCSync. Microsoft patched the AD CS flaw as CVE-2026-54121 on July 14, classing it as improper authorization with a CVSS score of 8.8, and the bug was absent from CISA's Known Exploited Vulnerabilities catalog on July 24.
Key Takeaway: Exploitation needs only a domain account and network access - no administrator rights and no user interaction - and a normal Domain Users account could create a computer account under the default ms-DS-MachineAccountQuota value of 10, so the bar to entry is an ordinary user credential. Microsoft has said it observed researcher testing tied to the flaw but has not confirmed active exploitation by threat actors, and it pointed to the public proof-of-concept as raising the odds of exploitation attempts.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-54121
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026