Start with Identity
Subscribe
Identity CVE · Kerberos / Active Directory

CVE-2026-27912ResetNightmare, kpasswd bypasses PAC_REQUESTOR_SID

high
Product: Active Directory (kpasswd)Vendor: MicrosoftDisclosed: 2026-04-14Status: PatchedNVD ↗

What broke

The Kerberos change-password path (kpasswd) did not apply PAC_REQUESTOR_SID the way ticket-granting did. A user who can write their own UPN can aim a password reset at a Domain Admin. Microsoft rated it Important and patched in April 2026. The research name is ResetNightmare.

Why it matters

"Important" from MSRC is not the same as "low priority." A low-priv user resetting DA is a domain-compromise bug that happens to sit on a less glamorous protocol (kpasswd, not TGS). UPN self-write is also more common than people think: help-desk tools, self-service, and poorly scoped ACL inheritances.

What to do

  • Patch DCs for April 2026.
  • Remove Write property (UPN) from users who do not need it. Audit who can write userPrincipalName on privileged accounts.
  • Monitor kpasswd / password-change events on admin accounts that did not go through your PAM or help-desk flow.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.