ResetNightmare: a low-priv UPN write can reset a Domain Admin via Kerberos kpasswd

Microsoft patched CVE-2026-27912 in April 2026. The Kerberos change-password path (kpasswd) did not apply PAC_REQUESTOR_SID the way ticket-granting did, so a user who can write their own UPN can point a password reset at a Domain Admin. The research name is ResetNightmare. MSRC called it Important. The identity impact is domain compromise that happens to sit on a less glamorous protocol than TGS.

UPN self-write is more common than people think: help-desk tools, self-service, poorly scoped ACL inheritances. Combined with KerberLoss (invisible-Unicode SPNs, March 2026) it made the first half of 2026 a Kerberos year. We published a practitioner brief in the identity CVE catalog with the hunt: password-change events on admin accounts that did not go through PAM.

Why it matters

"Important" from MSRC is a servicing label, not a risk rating. A low-priv user resetting DA is the same conversation as CheckSum and PKINIT, just on kpasswd. If your forest still allows users to write userPrincipalName, this CVE is in your threat model even after you patch the DC.

If you run Active Directory, confirm the April 2026 DC updates, remove UPN write from accounts that do not need it, and read the ResetNightmare brief.

Source: NVD: CVE-2026-27912