Active Directory Saw Two Different Names. Kerberos Saw the Same Identity.
Two Active Directory flaws show how a nearly invisible identity difference can become a domain-wide security failure. One can disrupt Kerberos-protected services. The other can let a low-privileged attacker reset a privileged account’s password and take over the domain.
Semperis researcher Shai Laron found that Windows identity handling did not consistently reject or normalise certain hidden Unicode characters. That allowed one identity to look different to an administrator or directory control while colliding with another identity inside a Kerberos workflow.
Microsoft patched the issues in March and April 2026. Semperis published the full technical analysis and a testing tool, making this more than a historical patch note. Defenders can now test exposure and hunt for the directory changes that enable the attacks.
KerberLoss turns SPN write access into service disruption
CVE-2026-25177, which Semperis calls KerberLoss, bypasses Service Principal Name uniqueness checks by using characters that one layer treats as distinct while Kerberos treats them as equivalent.
An attacker needs the ability to write an SPN on at least one user or computer object. That permission can come from delegated administration, an overly broad access control entry or control of an account that already has the right. The attacker can then create a conflicting SPN and disrupt Kerberos authentication for services mapped through the HOST class.
The result can be denial of service, Kerberos downgrade behaviour or an opening for SPN-jacking and constrained-delegation abuse, depending on the surrounding configuration. The new capability is not initial access. It is the ability to turn an identity write primitive into a broader authentication failure.
ResetNightmare reaches the password-change protocol
CVE-2026-27912, named ResetNightmare, is more severe in outcome. An attacker who can write a User Principal Name on an object can set that value to collide with another account’s SamAccountName. Kerberos then issues an enterprise ticket that can be used against the password-change protocol on port 464.
Semperis demonstrates that this can let the attacker reset the target account’s password and obtain a real Ticket Granting Ticket. If the target is a privileged account, the sequence can end in full domain takeover.
The attacker still needs a directory write primitive, such as Generic Write over a user or computer object, the ability to create an object, or another delegated permission. The target password must also satisfy the domain’s minimum password-age rule, which is one day by default. Those prerequisites matter, but they are common enough in complex Active Directory estates that defenders should test rather than assume.
| Vulnerability | What the attacker needs | What the attacker gains | Patch and PoC status |
|---|---|---|---|
| CVE-2026-25177 KerberLoss | Ability to write an SPN on a user or computer object. | SPN collision, service disruption, downgrade conditions and possible delegation abuse. | Microsoft patched it on 10 March 2026. Semperis published technical reproduction details. No confirmed malicious exploitation was identified. |
| CVE-2026-27912 ResetNightmare | Ability to write a UPN or create a suitable user or computer object; target password must meet minimum-age requirements. | Target password reset, TGT acquisition and potentially full domain takeover. | Microsoft patched it on 14 April 2026. Semperis released an open-source PowerShell testing tool. No confirmed malicious exploitation was identified. |
What defenders should do
- Patch every domain controller. Partial deployment leaves authentication behaviour inconsistent and the directory boundary exposed.
- Audit delegated write permissions. Review who can modify SPNs, UPNs, user objects and computer objects, including inherited and group-based permissions.
- Look for identity collisions. Detect hidden Unicode in SPNs and UPNs, duplicate-looking values and a UPN that matches another object’s
SamAccountName. - Monitor directory changes. Configure appropriate SACLs and review Security Event ID 5136 for unexpected SPN and UPN modifications.
- Test safely. Use the vendor-linked ResetNightmare tool in a controlled environment to validate whether intended directory controls hold.
The BlackTree view
Identity security often assumes that a name is a stable boundary. These flaws show the opposite: two layers can compare the same string differently, and the gap between those comparisons can become an attack path.
The patches matter, but the defensive lesson is broader. Permissions to edit identity attributes are security-sensitive capabilities. They should be treated with the same care as password reset and group-membership rights because a future parser or normalisation mismatch may turn them into exactly that.
Sources
- Semperis technical research: Identity Crisis, published 5 August 2026. No publication time was provided.
- Semperis disclosure announcement, published 26 August 2026. No publication time was provided.
- Microsoft advisory for CVE-2026-25177, published 10 March 2026.
- Microsoft advisory for CVE-2026-27912, published 14 April 2026.
