Executive Summary
In August 2026, researchers at Semperis disclosed two critical vulnerabilities affecting Active Directory environments: ResetNightmare (CVE-2026-27912) and KerberLoss (CVE-2026-25177). ResetNightmare is a logic bug in the Kerberos Change Password protocol (RFC 3244) that allows any low-privileged domain user to reset the password of any target account, including Domain Admins. This bypasses legacy security fixes, such as the 2021 Dollar Ticket patch, because the password change protocol (kpasswd) sidesteps the Ticket Granting Service (TGS-REQ) validation layer where requester SIDs are checked.
Simultaneously, KerberLoss (CVE-2026-25177) exploits the fact that Active Directory's LDAP engine ignores hundreds of Unicode characters. This allows attackers to bypass Service Principal Name (SPN) uniqueness checks, facilitating service hijacking, Kerberos constrained delegation abuse, and NTLM downgrade attacks. Both vulnerabilities were patched in Microsoft's March and April 2026 updates, but they were rated 'Important' rather than 'Critical,' potentially leading organizations to delay deployment.
The business impact is severe, as these vulnerabilities rely on the default 'self-write' permission for the userPrincipalName attribute, which is enabled for every domain account by default. Successful exploitation provides a trivial path from any standard domain user to full forest compromise. Organizations must ensure all Domain Controllers are patched and consider auditing default object permissions to mitigate these architectural risks.