Yes, CVE-2026-54121 is bad with a public working exploit out now (CertiGhost)… although it’s still worth noting that proper network segmentation would mitigate this. Also, the attacker must have a way to run a fake LDAP server, which is not hard if you already have access to the victim machine. Here’s a flow chart to visualize how bad this is: Attacker (low-privileged user) | | 1. Creates a | computer account v Starts fake LDAP server | | 2. Requests a | certificate for | Domain Controller | DC01 v Certificate Authority | | "I'll contact the | LDAP server you | told me about..." v Fake LDAP server controlled by attacker | | "Yep, that's DC01" v ❌!!! VULNERABILITY !!!❌ CA trusts the LDAP response WITHOUT properly verifying that it came from the real Domain Controller. | v CA issues a Domain Controller certificate to the attacker | v Attacker authenticates AS the Domain Controller | v Performs DCSync | v Full Active Directory compromise ✅ msrc.microsoft.com/update-gu…