Loading story…
Semperis disclosed two Active Directory privilege-escalation vulnerabilities involving hidden and unfilterable Unicode characters that can undermine Microsoft’s identity protections. The first flaw, KerberLoss (CVE-2026-25177), lets a low-privileged user with service principal name (SPN) write permissions bypass SPN and SPN-alias uniqueness checks, enabling denial of service against HOST-mapped services, SPN-jacking in constrained delegation scenarios, and forced Kerberos-to-NTLM downgrade. The second flaw, ResetNightmare (CVE-2026-27912), is more severe and allows an attacker who can write a user principal name (UPN) on a user or computer object to abuse NT-ENTERPRISE name handling and the Kerberos password-change protocol to reset a privileged account’s password and gain Domain Admin access.
The findings build on Microsoft’s earlier hardening work for CVE-2021-42282, which introduced uniqueness verification for UPNs, SPNs, and SPN aliases, but the new research shows those checks could still be bypassed under certain conditions. Microsoft patched KerberLoss in March 2026 and ResetNightmare in April 2026. Defenders were urged to update domain controllers, restrict delegated rights that allow SPN or UPN modification, and monitor Active Directory changes—particularly suspicious SPN and UPN edits such as Event ID 5136—for signs of exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft patched ResetNightmare, tracked as CVE-2026-27912. The vulnerability allowed a low-privileged attacker with UPN write access to reset a privileged account's password via Kerberos change-password abuse and ultimately obtain Domain Admin access.
Microsoft patched KerberLoss, tracked as CVE-2026-25177. The flaw allowed bypass of SPN and SPN-alias uniqueness checks using invisible unfilterable Unicode characters, enabling denial of service, SPN-jacking, and Kerberos-to-NTLM downgrade scenarios.
Microsoft's 2021 patch for CVE-2021-42282 added forest-wide uniqueness verification for user principal names, service principal names, and SPN aliases in Active Directory. This later became the baseline protection bypassed by the newly reported flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
semperis.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple **privilege escalation** vulnerabilities in core enterprise products, including **Active Directory Domain Services** and **SQL Server**, with public reporting highlighting network-reachable attack paths that require only authenticated or otherwise authorized access. **CVE-2026-25177** affects AD DS and was described as an elevation-of-privilege issue tied to improper restriction of file and resource names, enabling abuse of crafted Unicode characters to create duplicate `SPN` or `UPN` values. Reporting indicates this can interfere with Kerberos ticket handling, potentially causing denial of service, triggering fallback to **NTLM** where enabled, and ultimately enabling escalation to **SYSTEM**-level control in affected environments. Microsoft also disclosed **CVE-2026-21262** in **SQL Server**, an **Important**-rated flaw with a **CVSS 8.8** score that allows an authenticated attacker to elevate privileges to `sysadmin`, giving full control over the database instance. Public reporting said Microsoft assessed exploitation as **less likely** and had not observed active in-the-wild abuse at disclosure time, but noted the issue was publicly disclosed, increasing the risk of follow-on exploit development. Other referenced items about **ADCS ESC1**, **Cisco SD-WAN Manager**, and **n8n** concern separate products and unrelated vulnerabilities, while the standalone MSRC entry does not provide enough detail in the supplied content to confirm it is part of the same specific event.
Jun 29, 2026
Two separate Windows authentication weaknesses were highlighted as enabling high-impact **Active Directory** compromise via relay-style attacks. One issue, **CVE-2025-33073**, affects Windows **SMB client** authentication and enables **NTLM reflection**: attackers can coerce `lsass.exe` (running as **SYSTEM**) to authenticate to attacker-controlled infrastructure using techniques such as *PetitPotam*, *DFSCoerce*, and *Printerbug*, then relay/reflect that authentication to gain SYSTEM-level access and potentially full domain compromise. Reporting emphasized that despite a June 2025 patch, the condition remains widely present in enterprise environments due to incomplete patch adoption, and exploitation can be enabled with relatively low prerequisites such as the ability to register a malicious AD DNS record (often permitted to Authenticated Users by default) or to perform local DNS poisoning. A second technique described a **Kerberos relay** vector that abuses how Windows clients process **DNS CNAME** responses when building the SPN for TGS requests, allowing an on-path attacker (e.g., via ARP poisoning or DHCPv6/mitm6) to redirect victims to attacker-controlled services and obtain service tickets usable for relays and lateral movement. The write-up claims default configurations across Windows 10/11 and Windows Server 2022/2025 are susceptible, with potential impact including cross-protocol relays (e.g., HTTP→SMB/LDAP) and paths to RCE in some environments (e.g., via ADCS web enrollment scenarios). A separate Metasploit weekly wrap-up noted new and updated offensive modules (including AD privilege-escalation content), but it did not specifically tie to either of the two relay issues above.
Jun 30, 2026
Microsoft’s November 2024 security updates patched 89 vulnerabilities, including 52 remote code execution flaws and several critical issues across Windows, .NET, Visual Studio, Exchange Server, and Active Directory Certificate Services (AD CS). Among the most notable fixes was **CVE-2024-49019**, an AD CS privilege escalation bug tied to insecure certificate template configurations, alongside actively exploited flaws **CVE-2024-43451** in Windows NT LAN Manager and **CVE-2024-49039** in Windows Task Scheduler. Other critical vulnerabilities addressed included **CVE-2024-43498** in .NET and Visual Studio, **CVE-2024-43625** in Windows VMSwitch, **CVE-2024-43639** in Windows Kerberos, and **CVE-2024-49056** affecting `airlift.microsoft.com`. Research published alongside the updates highlighted how AD CS abuse can extend beyond previously cataloged escalation chains, describing an **EKUwu** technique that leverages certificate Extended Key Usage handling to obtain unintended privileges in misconfigured environments. The findings reinforced that organizations running AD CS face elevated risk when certificate templates are loosely controlled, and they underscored Microsoft’s guidance to rapidly deploy the November patches and review certificate template settings to reduce exposure to privilege escalation and identity compromise.
Jul 24, 2026