Loading vulnerability…
CVE-2026-27912, known as ResetNightmare, is an improper-authorization vulnerability in Windows Kerberos Active Directory domain controllers. An attacker able to modify the UserPrincipalName attribute of a user or computer object can manipulate a UPN to collide with a privileged account’s SamAccountName and request a ticket using the NT-ENTERPRISE principal-name type. Although protections introduced for CVE-2021-42287 validate PAC requestor information during TGS processing, the Kerberos password-change protocol processes an AP-REQ directly after TGT issuance and does not traverse that TGS validation path. The attacker can use the resulting ticket in the password-change flow to reset the targeted privileged account’s password.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single substantial Python exploit script, resetnightmare.py, plus README, requirements, and license. The script is presented as an exploit for CVE-2026-27912, a Windows Kerberos/Active Directory elevation-of-privilege issue enabling unauthorized password reset. Based on the README and visible code structure, the exploit automates a multi-step AD attack chain: manipulate a controlled account's UPN, request a Kerberos TGT using an enterprise-style name, clear or restore the UPN, perform a password reset against the chosen target, and verify success. The code is not a framework module; it is a standalone operational tool with CLI argument parsing, configuration defaults, logging, retry logic, status/result dataclasses, optional rich-text UI, and support for cleanup/rollback. It relies on external Windows tooling, especially Rubeus.exe, and likely shells out to PowerShell/AD commands for directory operations. The main capability is account takeover of arbitrary user or computer accounts in a vulnerable AD domain by setting a new password. Fingerprintable artifacts are mostly local file/tool references and AD-specific identifiers rather than hardcoded network IOCs; the Domain Controller is operator-supplied at runtime. Overall, this is an exploit tool rather than a detector, with practical attack automation but no highly modular payload framework, making OPERATIONAL the best maturity assessment.
This repository is a small standalone Python exploit tool for CVE-2026-27912 ('ResetNightmare'). It is not part of a larger exploit framework. The repository contains one substantive code file, resetnightmare.py, plus a README, requirements, license, and gitignore. The Python script is the clear entry point and implements the full attack workflow using impacket and ldap3. Core capability: the tool resets the password of a target Active Directory account by abusing enterprise principal name mapping during a Kerberos AS-REQ for the kadmin/changepw service. The operator authenticates to LDAP, identifies or creates a helper account ('UPNUser'), temporarily sets that account's userPrincipalName to the target account's sAMAccountName, requests a change-password TGT as an NT_ENTERPRISE principal, then uses kpasswd to set a new password on the target account. Afterward it clears/restores the helper account UPN. This is an active exploitation tool, not merely a detector. Repository structure and purpose: - README.md: documents the vulnerability, attack logic, prerequisites, usage examples, troubleshooting, and post-exploitation follow-up. - requirements.txt: declares impacket and ldap3 dependencies. - resetnightmare.py: main exploit implementation. Observed code structure from resetnightmare.py: - Argument parsing and CLI handling for operator credentials, target account, new password, helper account, Kerberos/NTLM auth modes, hashes/AES keys, LDAPS toggle, recon modes, and account creation path. - ADConnection class wrapping ldap3 operations for LDAP/LDAPS binds and directory actions. - Logic for reconnaissance (--find, --list-ous), including ACL/right evaluation to identify writable UPN targets and locations where new objects can be created. - Optional helper-account creation flow, including password setting and enablement, which requires LDAPS. - Kerberos TGT request logic via impacket getKerberosTGT using the service principal kadmin/changepw. - Password change execution via impacket.krb5.kpasswd.changePassword. - Cleanup/restoration logic to revert the fake UPN after exploitation. Network/target behavior: the exploit communicates directly with a domain controller over LDAP/LDAPS (389/636) and Kerberos password-change functionality. It accepts a DC hostname or IP and supports NTLM, pass-the-hash, or Kerberos LDAP bind modes. The README examples use 10.0.0.10 as the DC IP. The exploit targets AD user or computer accounts, including machine accounts ending in '$'. Overall assessment: this is an operational exploit/abuse tool for AD environments. It includes a real payload effect (credential reset), supports multiple authentication methods, performs prerequisite reconnaissance, and includes cleanup, making it more than a simple proof of concept.
This repository is a small, focused proof-of-concept for CVE-2026-27912 'ResetNightmare'. It contains one substantive code file, ResetNightmare.ps1, plus a README and license. The PowerShell function Invoke-ResetNightmare automates an Active Directory attack chain against an unpatched domain controller: it optionally creates a new user or computer object in a specified OU/container, grants the current operator GenericAll over that object, sets its password, enables it, changes its userPrincipalName to match the victim's sAMAccountName, requests a Kerberos TGT using Rubeus with principal type enterprise for the kadmin/changepw service, clears the fake UPN, and then uses the obtained ticket to reset the victim account's password. After success it deletes the temporary TGT file and restores the original UPN if one existed. The exploit targets both user and computer accounts and is operational rather than just demonstrative because it performs the full password-reset workflow and cleanup, but it relies on an external tool (Rubeus.exe) and a vulnerable AD environment. There are no hardcoded remote IPs or URLs; the main fingerprintable targets are AD/Kerberos identifiers, LDAP filters, the local Rubeus path, the temporary TGT file, and distinguished names/PSDrive roots used for directory manipulation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.