Researchers published a working proof-of-concept on July 24 for Certighost, tracked as CVE-2026-54121, showing that a standard Active Directory user can coerce Microsoft Active Directory Certificate Services (AD CS) into issuing a valid Domain Controller certificate. Microsoft shipped the fix on July 14.
The flaw is in AD CS "chase" behavior: the Enterprise CA follows requester-supplied routing data, accepts identity details from an attacker-controlled machine, and signs them as if they came from a real Domain Controller. Once that certificate exists, the attacker can use it for Kerberos public-key logon and reach Domain Controller-level trust.
That makes the blast radius Tier 0. Any environment that treats Enterprise CAs, smart card logon, or internal PKI as ordinary infrastructure inherits a trust problem: if the CA can be fooled into minting DC identity, the authentication boundary between a normal domain user and domain-wide control collapses.