Do Son 
TL;DR
Researchers published full details and a proof-of-concept tool for CVE-2026-27912, called ResetNightmare. The flaw sits in the Windows Kerberos Change Password protocol. It lets an attacker reset any Active Directory account password without knowing the old one. Successful abuse can grant SYSTEM privileges. Microsoft has patched the bug.
- CVE: CVE-2026-27912
- CVSS: 8.0 (High · CVSSv3)
- Product: Microsoft Windows Server 2012
- Affected: 6.2.9200.0, 6.3.9600.0, 10.0.14393.0, 10.0.17763.0, 10.0.20348.0, 10.0.25398.0 (+1 more)
- Impact: Windows Kerberos Elevation of Privilege Vulnerability
- Status: No confirmed exploitation yet
- Patched in: 6.2.9200.26026, 6.3.9600.23132, 10.0.14393.9060, 10.0.17763.8644 (+3 more)
- EPSS: 0.6% (30-day)
- Action: Update to 6.2.9200.26026, 6.3.9600.23132, 10.0.14393.9060, 10.0.17763.8644 (+3 more) now
Why This Matters
The public release raises the stakes for defenders. Both the vulnerability details and the proof-of-concept exploit code are now openly available. As a result, unpatched domain controllers face real risk. An attacker who wins the exploit “could gain SYSTEM privileges,” per Microsoft. That level of access can mean full domain compromise.
How the Attack Works
ResetNightmare is a validation flaw in the Kerberos Change Password protocol. The attacker first needs an account they control with write access to a userPrincipalName (UPN). Alternatively, permission to create new accounts also works.
The attacker sets their UPN to the target’s sAMAccountName, such as “Administrator.” Next, they request a TGT for that name using the NT-ENTERPRISE name type. After clearing their own UPN, they use the ticket to reset the target’s password. The account password then changes without the attacker ever knowing the original value.
Affected Versions
The flaw affects unpatched Windows domain controllers. The attack vector is adjacent (AV:A), so the attacker must sit inside the same restricted Active Directory domain. The bug carries a CVSS score of 8.0.
Patch and Mitigation
Microsoft patched this flaw in its April Patch Tuesday release. Admins should apply the update to all domain controllers now. Semperis published the ResetNightmare proof-of-concept tool on GitHub, which automates the full attack flow. No exploitation in the wild has been confirmed at this time.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
