CVE-2026-27912ResetNightmare, kpasswd bypasses PAC_REQUESTOR_SID
What broke
The Kerberos change-password path (kpasswd) did not apply PAC_REQUESTOR_SID the way ticket-granting did. A user who can write their own UPN can aim a password reset at a Domain Admin. Microsoft rated it Important and patched in April 2026. The research name is ResetNightmare.
Why it matters
"Important" from MSRC is not the same as "low priority." A low-priv user resetting DA is a domain-compromise bug that happens to sit on a less glamorous protocol (kpasswd, not TGS). UPN self-write is also more common than people think: help-desk tools, self-service, and poorly scoped ACL inheritances.
What to do
- Patch DCs for April 2026.
- Remove
Write property (UPN)from users who do not need it. Audit who can writeuserPrincipalNameon privileged accounts. - Monitor kpasswd / password-change events on admin accounts that did not go through your PAM or help-desk flow.
After you patch
Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.
- Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
- Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
- Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.
Sources
Related identity CVEs
Related on Start with Identity
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- CVEKerberLoss, invisible-Unicode SPN uniqueness bypass
Active Directory treated look-alike SPNs with invisible Unicode as unique. An attacker can hijack a service name, force NTLM downgrade, and steal credentials. S
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- CVESMB Server Kerberos reflection via Ghost SPNs
October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.
- RankingBest ITDR for Active Directory: Top 5 AD Security Platforms
The best ITDR platforms for Active Directory in 2026: Semperis, Microsoft Defender for Identity, Silverfort, Cayosoft, and Quest Change Auditor. Ranked for AD t
- GuideIAM Cloud Migration Guide: From On-Prem Active Directory to Cloud Identity
A practical guide to migrating from on-premises Active Directory to cloud IAM, covering hybrid identity architecture, migration phases, coexistence strategies,
Technique
This CVE is an instance of Kerberos delegation abuse. Delegation lets a service act as the user who called it, which is necessary for multi-tier applications and dangerous the moment the service or the delegation scope is not exactly what an administrator intended.