2026-08-09 · view entry permalink →
Two Active Directory identity-confusion flaws patched in spring got their full mechanics and a working proof-of-concept published this week — one takes a low-privileged user to Domain Admin by putting the target's name in their own UPN
Both of the week's Active Directory findings were fixed months ago, which is exactly why they belong in a strategic read rather than an operational one: what changed in 2026-W32 is not the exposure but the cost of exploiting it. At Black Hat USA 2026 Semperis published the full mechanics and a runnable proof-of-concept for two logical flaws it describes as taking "a unique approach to causing identity confusion on DCs, resulting in various impacts," adding that "the second (and more severe vulnerability) enables a low-privileged user to instantly gain Domain Admin privileges" (Semperis, 2026-08-05).
KerberLoss turns on name uniqueness. Active Directory enforces that a Service Principal Name is unique, but the check runs over a directory layer that cannot filter certain Unicode characters — so an attacker holding only the ability to write an SPN on any computer or user object can plant a duplicate the uniqueness check does not catch. The consequence is that Kerberos tickets get encrypted under the wrong account's key, producing authentication failures for the legitimate service, and — the part that matters operationally — pushing clients into an NTLM fallback, or enabling SPN hijacking as a stepping stone toward delegation abuse. The National Vulnerability Database records the flaw as "improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network," at CVSS 3.1 base 8.8 (NVD, 2026-03-10).
ResetNightmare is the more serious of the two and turns on where identity is checked. A low-privileged user sets their own user principal name to a target administrator's account name, then requests a ticket-granting ticket using the enterprise name type, so the ticket carries the target's name. They then drive the Kerberos password-change flow — which requires only a ticket-granting ticket — to reset a password while holding that borrowed identity, and authenticate as the administrator afterwards. Semperis locates the root cause precisely: the validation that would have caught the mismatch lives in a later request the password-change flow never makes, noting that "the TGS-REQ is where the PAC_REQUESTOR_SID validation occurs." NVD records it as "improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network," CVSS 3.1 base 8.0.
Triage: neither technique produces a failed authentication, so the signal is in directory-object modification rather than in logon telemetry. For ResetNightmare, the discriminator is a user principal name being set to a value that matches another account's logon name — a collision that has no legitimate cause — followed shortly by a password-reset event for the modifying account; either alone is unremarkable, the pair is not. For KerberLoss, audit for Service Principal Name values containing non-printing or unexpected Unicode characters, and for duplicate SPNs that the directory nonetheless accepted. The benign lookalikes are account renames and service-account migrations, both of which are change-managed and none of which produce an SPN with characters no administrator would type.
Each vulnerability takes a unique approach to causing identity confusion on DCs, resulting in various impacts. The second (and more severe vulnerability) enables a low-privileged user to instantly gain Domain Admin privileges.
Microsoft patched KerberLoss (CVE-2026-25177) in March 2026 and ResetNightmare (CVE-2026-27912) in April 2026.