Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

Researchers published a working exploit (Certighost) on 24 July that allows low-privileged Active Directory users to impersonate a Domain Controller by obtaining a forged certificate, enabling credential theft via DCSync; Microsoft patched the underlying AD CS flaw (CVE-2026-54121, CVSS 8.8) ten days earlier.

This Wire brief sits within Fusion42's coverage of Cybersecurity and Identity & Access. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.