Loading vulnerability…
ResetNightmare is a privilege escalation vulnerability in Windows Kerberos and Active Directory identity handling. It arises from improper authorization and name-binding behavior involving User Principal Name (UPN) manipulation and NT-ENTERPRISE Kerberos name processing. An attacker with low privileges who can modify the UPN attribute on a user or computer object can set a controlled object’s UPN to a value matching a target account’s SamAccountName without violating forest-wide UPN uniqueness checks, because the value does not need to equal the target’s actual UPN. By requesting a TGT using the NT-ENTERPRISE name type, the attacker can obtain a ticket that is interpreted as bearing the target account’s name while the PAC still contains the attacker’s SID. Although PAC_REQUESTOR_SID validation blocks this path during normal TGS processing, the vulnerability can be exploited through the Kerberos Change Password protocol, which uses an AP-REQ flow on port 464 and does not rely on the same TGS exchange path. By using that ticket in the password-change flow and then reverting or clearing the attacker-controlled UPN, the attacker can reset the privileged target account’s password and subsequently authenticate as that account.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit tool for CVE-2026-27912 ('ResetNightmare'). It is not part of a larger exploit framework. The repository contains one substantive code file, resetnightmare.py, plus a README, requirements, license, and gitignore. The Python script is the clear entry point and implements the full attack workflow using impacket and ldap3. Core capability: the tool resets the password of a target Active Directory account by abusing enterprise principal name mapping during a Kerberos AS-REQ for the kadmin/changepw service. The operator authenticates to LDAP, identifies or creates a helper account ('UPNUser'), temporarily sets that account's userPrincipalName to the target account's sAMAccountName, requests a change-password TGT as an NT_ENTERPRISE principal, then uses kpasswd to set a new password on the target account. Afterward it clears/restores the helper account UPN. This is an active exploitation tool, not merely a detector. Repository structure and purpose: - README.md: documents the vulnerability, attack logic, prerequisites, usage examples, troubleshooting, and post-exploitation follow-up. - requirements.txt: declares impacket and ldap3 dependencies. - resetnightmare.py: main exploit implementation. Observed code structure from resetnightmare.py: - Argument parsing and CLI handling for operator credentials, target account, new password, helper account, Kerberos/NTLM auth modes, hashes/AES keys, LDAPS toggle, recon modes, and account creation path. - ADConnection class wrapping ldap3 operations for LDAP/LDAPS binds and directory actions. - Logic for reconnaissance (--find, --list-ous), including ACL/right evaluation to identify writable UPN targets and locations where new objects can be created. - Optional helper-account creation flow, including password setting and enablement, which requires LDAPS. - Kerberos TGT request logic via impacket getKerberosTGT using the service principal kadmin/changepw. - Password change execution via impacket.krb5.kpasswd.changePassword. - Cleanup/restoration logic to revert the fake UPN after exploitation. Network/target behavior: the exploit communicates directly with a domain controller over LDAP/LDAPS (389/636) and Kerberos password-change functionality. It accepts a DC hostname or IP and supports NTLM, pass-the-hash, or Kerberos LDAP bind modes. The README examples use 10.0.0.10 as the DC IP. The exploit targets AD user or computer accounts, including machine accounts ending in '$'. Overall assessment: this is an operational exploit/abuse tool for AD environments. It includes a real payload effect (credential reset), supports multiple authentication methods, performs prerequisite reconnaissance, and includes cleanup, making it more than a simple proof of concept.
This repository is a small, focused proof-of-concept for CVE-2026-27912 'ResetNightmare'. It contains one substantive code file, ResetNightmare.ps1, plus a README and license. The PowerShell function Invoke-ResetNightmare automates an Active Directory attack chain against an unpatched domain controller: it optionally creates a new user or computer object in a specified OU/container, grants the current operator GenericAll over that object, sets its password, enables it, changes its userPrincipalName to match the victim's sAMAccountName, requests a Kerberos TGT using Rubeus with principal type enterprise for the kadmin/changepw service, clears the fake UPN, and then uses the obtained ticket to reset the victim account's password. After success it deletes the temporary TGT file and restores the original UPN if one existed. The exploit targets both user and computer accounts and is operational rather than just demonstrative because it performs the full password-reset workflow and cleanup, but it relies on an external tool (Rubeus.exe) and a vulnerable AD environment. There are no hardcoded remote IPs or URLs; the main fingerprintable targets are AD/Kerberos identifiers, LDAP filters, the local Rubeus path, the temporary TGT file, and distinguished names/PSDrive roots used for directory manipulation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.