Loading story…
A published proof of concept for ResetNightmare (CVE-2026-27912) reportedly allows attackers to reset another user or computer account’s password on unpatched Active Directory domain controllers without knowing the existing password. The Kerberos Change Password validation flaw requires an attacker-controlled account with WriteProperty permission on its own userPrincipalName (UPN) attribute. The attack changes that UPN to spoof a target identity, obtains a Kerberos ticket using NT-ENTERPRISE and the kadmin/changepw service, clears the UPN, and resets the target password. The implementation uses ResetNightmare.ps1, the ActiveDirectory PowerShell module, and Rubeus.exe. The report provides no evidence of exploitation in the wild and cautions that its automatically extracted indicators were not externally verified.
Splunk has published a detection for the attack’s setup stage that searches Windows Security Event 4738 for accounts modifying their own UPN to a value without an @ sign, excluding placeholders and selected system identities. The analytic requires domain-controller security logs and User Account Management auditing, is disabled by default, and can flag legitimate provisioning or migration activity. Security teams should verify domain-controller patch status, review permissions allowing accounts to modify their own UPN, and enable and tune the detection against normal account-management workflows. Suspicious matches warrant investigation for subsequent password changes and potential account takeover.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk updated its Windows AD User Suspicious UPN Change detection to identify account self-modifications associated with ResetNightmare (CVE-2026-27912). The analytic examines Windows Security Event 4738 for suspicious UPN values without an @ sign and requires Domain Controller account-management audit logs.
A published proof of concept demonstrates how CVE-2026-27912 can enable unauthorized password resets for target user or computer accounts on unpatched Active Directory domain controllers. It manipulates an attacker-controlled account's userPrincipalName and obtains a Kerberos kadmin/changepw ticket; exploitation requires permission to modify that account's UPN.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceresearch.splunk.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Semperis disclosed two Active Directory privilege-escalation vulnerabilities involving hidden and unfilterable Unicode characters that can undermine Microsoft’s identity protections. The first flaw, **KerberLoss** (`CVE-2026-25177`), lets a low-privileged user with service principal name (SPN) write permissions bypass SPN and SPN-alias uniqueness checks, enabling denial of service against `HOST`-mapped services, SPN-jacking in constrained delegation scenarios, and forced Kerberos-to-NTLM downgrade. The second flaw, **ResetNightmare** (`CVE-2026-27912`), is more severe and allows an attacker who can write a user principal name (UPN) on a user or computer object to abuse NT-ENTERPRISE name handling and the Kerberos password-change protocol to reset a privileged account’s password and gain Domain Admin access. The findings build on Microsoft’s earlier hardening work for `CVE-2021-42282`, which introduced uniqueness verification for UPNs, SPNs, and SPN aliases, but the new research shows those checks could still be bypassed under certain conditions. Microsoft patched **KerberLoss** in March 2026 and **ResetNightmare** in April 2026. Defenders were urged to update domain controllers, restrict delegated rights that allow SPN or UPN modification, and monitor Active Directory changes—particularly suspicious SPN and UPN edits such as **Event ID 5136**—for signs of exploitation.
Aug 6, 2026
Kroll published detection guidance for **CVE-2020-1472** (**Zerologon**), the critical Microsoft Netlogon flaw that allows attackers to compromise **Active Directory domain controllers**. The guidance followed Microsoft's advisory and focused on identifying whether attackers had already abused the bug in the wild, a risk highlighted by warnings from Microsoft, DHS, and the FBI, including reports of active exploitation by state-backed actors. The detection playbook describes three common attack paths: resetting a domain controller computer-account password and leaving it changed, resetting it and later restoring the original password, and using a **printer spooler plus NTLM relay** technique that avoids a password reset entirely. Kroll said defenders should review Windows security events including `4624`, `4742`, and in some cases `5805`, examine domain controller password-hash history for null-password resets or restored credentials, inspect **LSASS** memory with Yara-based methods, and use **Snort** or **Suricata** to spot scans and exploitation attempts on the network.
Aug 21, 2026
Splunk published two detections for Active Directory service principal name (SPN) manipulation, including the KerberLoss technique associated with **CVE-2026-25177**, which Microsoft lists as an Active Directory Domain Services elevation-of-privilege vulnerability. According to Splunk, inconsistent normalization between LDAP uniqueness checks and the Kerberos Key Distribution Center allows SPNs containing invisible Unicode characters to collide, potentially disrupting Kerberos authentication or forcing clients to fall back to NTLM. One analytic flags suspicious Unicode in SPN changes; the other detects non-machine accounts adding or removing SPNs on computer objects, activity that can reflect abuse of delegated WriteProperty permissions. Splunk also released an attack-simulation dataset capturing both behaviors; the references do not establish exploitation in the wild. Both analytics rely on **Windows Security Event 5136** and require domain controller Security logs, successful Directory Service Changes auditing, and appropriate WriteProperty audit SACLs on monitored objects. Defenders should verify these prerequisites, enable the detections—which are disabled by default—and investigate the modifying account, affected object, and changed SPN values. Microsoft recommends correlating Value Added and Value Deleted events using their shared Correlation ID to reconstruct attribute changes. Legitimate administration and provisioning can trigger the broader SPN-modification analytic, which produces intermediate risk findings rather than direct notable alerts; the Unicode-collision analytic is expected to generate few false positives. Review delegated SPN-write permissions and distinguish authorized changes from suspicious modifications.
Oct 10, 2026