www.it-connect.fr
ResetNightmare: Kerberos Flaw Lets Attackers Take Over Active Directory Domains
At Black Hat USA 2026, Semperis unveiled a new security flaw tied to Active Directory and Kerberos authentication: ResetNightmare (CVE-2026-27912). It makes it possible to reset the password of any Active Directory account, including a Domain Administrator account, without ever knowing the old one. Here’s the key information you need to know about this security issue.
Reset a password without knowing the old one
This security flaw was discovered by Shai Laron, a researcher at Semperis, and presented at Black Hat USA 2026 alongside a second Kerberos vulnerability nicknamed KerberLoss (CVE-2026-25177). If I’m mentioning this second flaw, it’s because both follow the same logic: they create confusion about object identities on domain controllers. Let me explain how.
As part of his research, Shai Laron took a closer look at a talk by Yossi Sassi on persistence techniques in Active Directory, especially the addition of invisible Unicode characters in object attributes. Two accounts that appear to have the same name, but are separated by a character nobody can see. Not all of these characters are handled the same way by the LDAP directory:
- Only 106 out of 385 characters are actually filterable.
- Some are treated as spaces, which causes all objects containing them in their name to be returned (such as the "Domain Admins" group, for example).
- Others are ignored by the domain controller. A query involving one of them returned the researcher’s entire test directory, meaning 11,704 objects.
This anomaly is what makes it possible to bypass the UPN and SPN uniqueness checks introduced by Microsoft in 2021. That is what led to the first flaw: KerberLoss.
The principle behind ResetNightmare is this: an attacker who controls a user account, or who has the right to create accounts in the directory, can force another account’s password to be reset. The killer detail: they do not need to know the target account’s current password (otherwise it would be pointless). Starting from a standard user account, compromising the Active Directory domain becomes feasible.
"The simple fact of being able to create a UPN was enough to compromise the domain." Shai Laron notes in his report. This security flaw, associated with CVE-2026-27912, has been assigned a CVSS score of 8.0 out of 10 by Microsoft. If it is not considered critical, that is probably because authenticated access to the targeted Active Directory domain is required.
How the flaw bypasses a 2021 protection
To understand where the ResetNightmare security flaw comes from, we need to go back a few years. More specifically, to 2021, when Microsoft fixed the Dollar Ticket (noPac) attack associated with CVE-2021-42278 and CVE-2021-42287. It already relied on name confusion, and Microsoft had added preventive measures. In fact, the authentication ticket (TGT) now always includes a PAC, and this PAC contains a PAC_REQUESTOR_SID field carrying the SID of the account that actually requested the ticket. This value is then checked during the TGS exchange, which blocks any impersonation attempt.
As Shai Laron explains, the problem is that the Kerberos password change protocol never goes through this step. As a result, the SID check introduced in 2021 does not apply. All that remains is to obtain a TGT bearing the name of another targeted account, preferably one with elevated privileges. That is where the userPrincipalName (UPN) attribute comes into play.
There is no need to bypass the uniqueness check: the attacker simply sets their own UPN to the value of the target’s sAMAccountName, which is still allowed because the victim’s real UPN includes the domain suffix and the two strings differ. By requesting a ticket with the Kerberos name type NT-ENTERPRISE, which resolves accounts by their UPN, they obtain a TGT displaying the target’s name. They then remove their own UPN, so no account matches the name shown on the ticket anymore. A classic impersonation would fail here with a KDC_ERR_TGT_REVOKED error, proving that the 2021 patch is doing its job, but the same ticket, when used to build a password change request, slips through all of the defenses!
The target’s password is reset, and the attacker can then take over the target code! And if I’m telling you about it today, it’s because a proof of concept (PoC) exploit has been published on GitHub by Semperis. This means the flaw is now relatively easy to exploit.
You can find all the details in Semperis’ report.
How do you protect yourself against the ResetNightmare flaw?
The good news is that Microsoft has already released a security fix for this vulnerability, during the April 2026 Patch Tuesday. ResetNightmare was therefore patched in April 2026, while KerberLoss was patched earlier, in March 2026. Enough to protect yourself against this technique.
You therefore need to have installed, at a minimum, the following updates on your servers (if you installed the August 2026 ones, that’s even better).
- Windows Server 2012: KB5082127.
- Windows Server 2012 R2: KB5082126.
- Windows Server 2016: KB5082198.
- Windows Server 2019: KB5082123.
- Windows Server 2022 (21H2 and 22H2): KB5082142.
- Windows Server 2022 23H2: KB5082060.
- Windows Server 2025: KB5082063.
As an additional step to map attack paths within your Active Directory, you can read our article explaining how to generate an Active Directory security report with AD-Miner and BloodHound.
