CVE-2026-27912 lets a user who can write their own UPN aim a Kerberos change-password at a Domain Admin. Microsoft rated it Important. Identity teams should not.