Some Unicode characters are invisible, and Active Directory's LDAP server ignores them entirely. Semperis researcher Shai Laron built two attacks on that single fact, and the worse of them lets a low-privileged user reset the password of any account in the domain, including a domain administrator, without ever knowing the old one.
Both are patched. The question is whether your domain controllers took the update.
Peru's national digital security centre, the CNSD, reissued the findings to national entities on 31 August, several weeks after Laron published the research on 5 August following talks at Black Hat and DEF CON. Microsoft fixed the first flaw on 10 March 2026 and the second on 14 April 2026, so the patches have been available for months.
Characters LDAP refuses to see
KerberLoss, tracked as CVE-2026-25177, abuses invisible and unfilterable Unicode characters inserted into Service Principal Names, the identifiers Active Directory uses to work out which service a Kerberos ticket is for. Those characters slip past the uniqueness check that is supposed to stop two services claiming the same name, which lets a low-privileged user with write access to an SPN create a conflicting one. Laron describes three outcomes: denial of service against HOST-mapped services across the forest, SPN-jacking to set up constrained delegation attacks, and forcing authentication to fall back from Kerberos to the older, weaker NTLM. NVD scores it 8.8, high. Microsoft patched it on 10 March 2026.
Resetting a password you never knew
ResetNightmare, tracked as CVE-2026-27912, is the severe one. It targets the Kerberos Change Password protocol. An attacker sets the User Principal Name of an account they control to match a target account's SamAccountName, requests a ticket using the NT-ENTERPRISE name type, and uses the resulting ticket to reset the target's password without tripping the PAC_REQUESTOR_SID check that should have caught the identity mismatch. Semperis says that gives a low-privileged user domain administrator rights immediately. NVD scores it 8.0, high, and Microsoft patched it on 14 April 2026.
Important, or a full domain takeover
Microsoft classified both as Important elevation of privilege issues. Semperis disagrees with that weighting, arguing the central role Active Directory plays in enterprise identity makes them severe, and its wider point is that an attacker does not need to steal an administrator's password if they can instead confuse the machinery that decides who an administrator is.
Patch the controllers, then watch event 5136
The fix is to apply the March and April 2026 Microsoft updates across every domain controller, which is the only step that actually closes either hole. For detection, Laron points at Windows security event ID 5136, which records directory object modifications: watch it for conflicting SPN additions, and for a UPN value being set to match an existing SamAccountName, which is the tell for ResetNightmare. Configure SACLs so those modifications are audited in the first place. Beyond that, restrict write permissions on user and computer objects, keep the minimum password age at its default of one day, and strip administrative rights from ordinary accounts.
Identity infrastructure keeps turning out to be the shortest route to everything else. Attackers recently talked their way past help desks to reach domain controllers directly, and the downgrade path KerberLoss opens leads back to the same NTLM weaknesses that let a single click leak a password hash. Neither of these bugs needs a zero-day to matter now. It only needs a domain controller that missed a Patch Tuesday.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.