This Week in Identity, Issue 9
Issue 9 of This Week in Identity. Two new Active Directory techniques, and a lesson in how fast a public proof of concept becomes a campaign.
In brief
- ResetNightmare lets a low-privilege account with a UPN write reset a Domain Admin password through Kerberos kpasswd, with no exploit and no CVE.
- KerberLoss uses invisible Unicode characters to register a Kerberos SPN that looks identical to a legitimate one.
- A SharePoint proof of concept went public and mass exploitation followed within 48 hours, against a patch that had been available for a month.
The big story
ResetNightmare turns a directory permission into a domain takeover. An account that can write a userPrincipalName can set it to match a Domain Admin, then use Kerberos kpasswd to reset that admin's password. There is no memory corruption and no vulnerability in the usual sense. Every step is the directory working as specified.
Why it matters: this is the defining property of the directory and trust category, and it is why patch management alone never fixes Active Directory. The attack surface is the permission model, and the permission that enables this is routinely delegated to help desk tooling, HR sync jobs, and provisioning service accounts that nobody has reviewed since they were created. Audit who can write UPN and servicePrincipalName across your directory. Most organizations find the answer surprising. Sources: ResetNightmare, KerberLoss.
Patch this week
- CVE-2026-55040, SharePoint. Exploitation began within 48 hours of Rapid7's public PoC, against a July patch. Post.
- CVE-2026-64849, MLflow (CVSS 9.3). An SSRF reaching cloud metadata services; scanning started hours after CVE assignment. Post.
- Fortinet SSO bypass, which hit appliances already patched for the December SAML bug. Two fixes, one still-open door. Post.
The pattern
Both AD techniques abuse naming. KerberLoss registers a service principal name that is visually identical to a real one using invisible Unicode; ResetNightmare rewrites a user principal name to impersonate an admin. Identifiers in a directory are compared as strings, and humans review them by eye. Any control that relies on an operator recognising a name is weaker than it looks. Related: Kerberoasting and Kerberos delegation abuse.
What else happened
- RecruitTrap ran 3,000 fake recruitment logins using browser-in-the-browser popups with a spoofed address bar and padlock, relaying MFA codes live. "Check the URL" fails when the URL bar is a
div. Post. - 1.6 million RingCentral records leaked after ShinyHunters voice-phished one employee out of a password. No exploit anywhere in the chain. Post.
- An MLflow SSRF reached cloud metadata services, which makes every SSRF in a cloud-hosted app an identity problem: the metadata endpoint authenticates callers by network position alone. Post.
New from Start with Identity
- The identity CVE catalog launched with 75 practitioner briefs, protocol pages, and a 2023-24 backfill. Not NVD descriptions: what broke, who can become whom, and what to do. Browse /cves/.
From the community
The CVE catalog is built to be corrected. If a brief gets a version, a severity, or a timeline wrong, tell us through the contact form and we will fix and credit it.
That's Issue 9. Subscribe for the next one.