ResetNightmare: a low-priv UPN write can reset a Domain Admin via Kerberos kpasswd
CVE-2026-27912 lets a user who can write their own UPN aim a Kerberos change-password at a Domain Admin. Microsoft rated it Important. Identity teams should not.
Microsoft patched CVE-2026-27912 in April 2026. The Kerberos change-password path (kpasswd) did not apply PAC_REQUESTOR_SID the way ticket-granting did, so a user who can write their own UPN can point a password reset at a Domain Admin. The research name is ResetNightmare. MSRC called it Important. The identity impact is domain compromise that happens to sit on a less glamorous protocol than TGS.
UPN self-write is more common than people think: help-desk tools, self-service, poorly scoped ACL inheritances. Combined with KerberLoss (invisible-Unicode SPNs, March 2026) it made the first half of 2026 a Kerberos year. We published a practitioner brief in the identity CVE catalog with the hunt: password-change events on admin accounts that did not go through PAM.
Why it matters
"Important" from MSRC is a servicing label, not a risk rating. A low-priv user resetting DA is the same conversation as CheckSum and PKINIT, just on kpasswd. If your forest still allows users to write userPrincipalName, this CVE is in your threat model even after you patch the DC.
If you run Active Directory, confirm the April 2026 DC updates, remove UPN write from accounts that do not need it, and read the ResetNightmare brief.
Source: NVD: CVE-2026-27912
Related on Start with Identity
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- BlogQilin and INC use the GlobalProtect auth bypass to skip MFA, then dump domain controller disks
Unit 42's October 19 update says Qilin and INC ransomware operators are exploiting CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions without MFA, then
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- CVEKeycloak password reset skips re-validation against AD
Keycloak did not re-check Active Directory on password reset. An expired or disabled AD account could regain access through Keycloak's reset flow.
- CVEWindows Kerberos KDC hands out RC4 service tickets for Kerberoasting
Domain controllers issued RC4-encrypted service tickets to accounts with no explicit encryption setting, which an attacker can crack offline for the service acc
- CVEFreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI fla