ResetNightmare: a low-priv UPN write can reset a Domain Admin via Kerberos kpasswd
CVE-2026-27912 lets a user who can write their own UPN aim a Kerberos change-password at a Domain Admin. Microsoft rated it Important. Identity teams should not.
Microsoft patched CVE-2026-27912 in April 2026. The Kerberos change-password path (kpasswd) did not apply PAC_REQUESTOR_SID the way ticket-granting did, so a user who can write their own UPN can point a password reset at a Domain Admin. The research name is ResetNightmare. MSRC called it Important. The identity impact is domain compromise that happens to sit on a less glamorous protocol than TGS.
UPN self-write is more common than people think: help-desk tools, self-service, poorly scoped ACL inheritances. Combined with KerberLoss (invisible-Unicode SPNs, March 2026) it made the first half of 2026 a Kerberos year. We published a practitioner brief in the identity CVE catalog with the hunt: password-change events on admin accounts that did not go through PAM.
Why it matters
"Important" from MSRC is a servicing label, not a risk rating. A low-priv user resetting DA is the same conversation as CheckSum and PKINIT, just on kpasswd. If your forest still allows users to write userPrincipalName, this CVE is in your threat model even after you patch the DC.
If you run Active Directory, confirm the April 2026 DC updates, remove UPN write from accounts that do not need it, and read the ResetNightmare brief.
Source: NVD: CVE-2026-27912
Related on Start with Identity
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- BlogA CVSS 10.0 Metabase zero-day handed admin access through the password reset endpoint
CVE-2026-72898 lets an unauthenticated attacker inject SQL through Metabase's password reset endpoint and take administrative control. It was exploited as a zer
- CVEKeycloak password reset skips re-validation against AD
Keycloak did not re-check Active Directory on password reset. An expired or disabled AD account could regain access through Keycloak's reset flow.
- CVELDAPNightmare, domain-controller DoS via crafted LDAP response
A crafted LDAP response crashes the Windows LDAP client and can take a domain controller down. SafeBreach published a PoC in January 2025. High. Patched Decembe
- CVESMB Server Kerberos reflection via Ghost SPNs
October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.