T1210: Domain Controllers Unpatched for CVE-2026-27912/CVE-2026-25177 (ResetNightmare/KerberLoss)

Tim Peck@timpeck

•updated Aug 20, 2026•17•0•31

This rule identifies Windows Server devices, specifically potential Domain Controllers, that are flagged as vulnerable to CVE-2026-27912 (ResetNightmare) and CVE-2026-25177 (KerberLoss). It checks for the absence of the March/April 2026 cumulative updates that address critical Kerberos Change Password and Service Principal Name (SPN) logic flaws.