[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"focus:certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-doma-ms00yvwn":3},{"item":4},{"id":5,"title":6,"slug":7,"summary":8,"severity":9,"category":10,"cve_ids":11,"affected_products":13,"action_required":16,"article_ids":17,"ioc_summary":19,"source_urls":20,"status":22,"expires_at":23,"created_at":24,"updated_at":25,"articles":26},"409bcbb5-a378-487a-8334-9d568e07cbd5","Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller","certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-doma-ms00yvwn","Certighost (CVE-2026-54121) allows any domain user to obtain a Domain Controller certificate and execute DCSync attacks to steal the krbtgt secret without admin rights. This gives attackers a direct path to full domain compromise. Any organization running unpatched Active Directory is at immediate risk.","critical","advisory",[12],"CVE-2026-54121",[14,15],"Windows Server","Microsoft","Patch all domain controllers and CA servers for CVE-2026-54121 immediately. Hunt for suspicious certificate requests from low-privileged accounts and monitor for DCSync activity via Directory Replication Service (DRS) protocols.",[18],"f3bb9fd4-4f1e-426d-a713-4b32ec3674c6",null,[21],"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fcertighost-exploit-lets-low-privileged.html","active","2026-07-27T07:05:40.603+00:00","2026-07-25T07:05:43.238154+00:00","2026-07-25T07:07:47.319125+00:00",[27],{"id":18,"title":6,"url":21}]