New PoC Exploit Lets Low-Privilege Users Hijack Windows Domains via AD CS

A public proof-of-concept exploit for CVE-2026-54121 allows attackers with a low-privilege domain account to impersonate a Domain Controller by tricking Active Directory Certificate Services. The attack chains LDAP, fake services, and PKINIT to achieve full domain takeover via DCSync. Microsoft's July 2026 patch blocks the vulnerability, but unpatched systems remain at risk.