Two Active Directory identity-confusion flaws patched in spring got their full mechanics and a working proof-of-concept published this week — one takes a low-privileged user to Domain Admin by putting the target's name in their own UPN
Both of the week's Active Directory findings were fixed months ago, which is exactly why they belong in a strategic read rather than an operational one: what changed in 2026-W32 is not the exposure but the cost of exploiting it. At Black Hat USA 2026 Semperis published the full mechanics and a runnable proof-of-concept for two logical flaws it describes as taking "a unique approach to causing identity confusion on DCs, resulting in various impacts," adding that "the second (and more severe vulnerability) enables a low-privileged user to instantly gain Domain Admin privileges" (Semperis, 2026-08-05).
KerberLoss turns on name uniqueness. Active Directory enforces that a Service Principal Name is unique, but the check runs over a directory layer that cannot filter certain Unicode characters — so an attacker holding only the ability to write an SPN on any computer or user object can plant a duplicate the uniqueness check does not catch. The consequence is that Kerberos tickets get encrypted under the wrong account's key, producing authentication failures for the legitimate service, and — the part that matters operationally — pushing clients into an NTLM fallback, or enabling SPN hijacking as a stepping stone toward delegation abuse. The National Vulnerability Database records the flaw as "improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network," at CVSS 3.1 base 8.8 (NVD, 2026-03-10).
ResetNightmare is the more serious of the two and turns on where identity is checked. A low-privileged user sets their own user principal name to a target administrator's account name, then requests a ticket-granting ticket using the enterprise name type, so the ticket carries the target's name. They then drive the Kerberos password-change flow — which requires only a ticket-granting ticket — to reset a password while holding that borrowed identity, and authenticate as the administrator afterwards. Semperis locates the root cause precisely: the validation that would have caught the mismatch lives in a later request the password-change flow never makes, noting that "the TGS-REQ is where the PAC_REQUESTOR_SID validation occurs." NVD records it as "improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network," CVSS 3.1 base 8.0.
Triage: neither technique produces a failed authentication, so the signal is in directory-object modification rather than in logon telemetry. For ResetNightmare, the discriminator is a user principal name being set to a value that matches another account's logon name — a collision that has no legitimate cause — followed shortly by a password-reset event for the modifying account; either alone is unremarkable, the pair is not. For KerberLoss, audit for Service Principal Name values containing non-printing or unexpected Unicode characters, and for duplicate SPNs that the directory nonetheless accepted. The benign lookalikes are account renames and service-account migrations, both of which are change-managed and none of which produce an SPN with characters no administrator would type.
Each vulnerability takes a unique approach to causing identity confusion on DCs, resulting in various impacts. The second (and more severe vulnerability) enables a low-privileged user to instantly gain Domain Admin privileges.
Microsoft patched KerberLoss (CVE-2026-25177) in March 2026 and ResetNightmare (CVE-2026-27912) in April 2026.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078.002Valid Accounts: Domain Accounts
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Persistence TA0003
T1078.002Valid Accounts: Domain Accounts
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
T1098Account Manipulation
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
Privilege Escalation TA0004
T1078.002Valid Accounts: Domain Accounts
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
T1098Account Manipulation
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
Stealth TA0005
T1078.002Valid Accounts: Domain Accounts
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Credential Access TA0006
T1558Steal or Forge Kerberos Tickets
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.