CVE-2026-27912 - ResetNightmare: AD takeover via Kerberos password change

Semperis researcher Shai Laron found two Active Directory bugs in how AD enforces name uniqueness. KerberLoss (CVE-2026-25177) smuggles unfilterable Unicode past Service Principal Name uniqueness checks to force a Kerberos-to-NTLM downgrade or a service DoS, while the nastier ResetNightmare (CVE-2026-27912) lets anyone with write access to an object manipulate User Principal Names to impersonate an administrator through the Kerberos password-change protocol. It sidesteps the PAC_REQUESTOR_SID validation that was supposed to have closed this class of attack: full domain takeover from a single write permission, and this time the invisible characters weren’t even needed.