Semperis demonstrates how two Kerberos logic flaws can turn any domain user into a domain administrator: A Semperis researcher’s detour into “invisible” Unicode characters in Active Directory objects led to the discovery of two Kerberos logic flaws — one capable of silently downgrading authentication to NTLM, the other allowing any domain user to reset a Domain Admin’s password without ever touching it.
The research behind KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912), presented by Semperis researcher Shai Laron at Black Hat USA 2026, did not start as a hunt for a Kerberos exploit. It started with a talk on how attackers hide malicious accounts using Unicode characters Active Directory doesn’t render — and ended with two logic flaws that let a low-privileged user disrupt domain authentication, force a fallback to the aging NTLM protocol, or seize full Domain Admin control.
From persistence trick to protocol flaw. Laron’s starting point was a talk by researcher Yossi Sassi on Active Directory persistence, which showed how “invisible” Unicode characters inserted into object attributes can make a malicious account appear identical to a legitimate one in administrative tools. Curious whether Active Directory’s LDAP server handled other invisible characters the same way, Laron compiled a list of 385 candidate Unicode characters and tested each one against a live domain controller. Of those, only 106 could reliably be filtered for in LDAP queries; the rest were either treated as whitespace or ignored outright by the directory service — a gap he found held even after experimenting with LDAP’s language-specific sorting extensions, none of which closed it.
Bypassing uniqueness checks. That gap turned out to matter because of a 2021 Microsoft patch (CVE-2021-42282) that introduced forest-wide uniqueness checks for three values: User Principal Names, Service Principal Names, and SPN aliases. Ordinarily, a low-privileged user attempting to set a duplicate value is blocked. But because the unfilterable Unicode characters are invisible to the uniqueness check while being ignored by LDAP queries, Laron found he could register values that appear identical to existing ones without ever triggering the block — the mechanism behind KerberLoss.
Three ways to weaponize it. Laron demonstrated three practical impacts of this SPN confusion, all achievable with only WriteSPN rights on a single computer or user object anywhere in the forest. First, an attacker can disrupt any service mapped to a machine’s default HOST-class SPN — such as file shares or Remote Desktop — by registering a conflicting SPN elsewhere, causing the Kerberos service ticket to be encrypted with the wrong key and access to fail. Second, building on a Kerberos delegation technique previously described by researcher Elad Shamir, an attacker can hijack constrained-delegation trust paths without needing write access to the intermediate server at all. Third, and most notable for defenders, creating an exact duplicate of an explicit SPN causes the domain controller to return an ambiguous-principal error, silently forcing the affected service to fall back from Kerberos to NTLM — a legacy protocol long exploited for credential relay and theft — while users see no visible disruption.
The breakthrough: abusing password changes. Laron then tried to revive the logic behind the 2021 “Dollar Ticket” and noPac vulnerabilities (CVE-2021-42287, CVE-2021-42278), which had let attackers impersonate any account through name confusion before Microsoft closed the gap with a mandatory PAC_REQUESTOR_SID identity check. That check runs during the standard ticket-granting-service exchange — but Laron found that Kerberos’s password-change protocol (RFC 3244, served on port 464) skips that exchange entirely, going straight from a ticket-granting ticket to an authenticated request. The identity check built to prevent name spoofing simply never fires in that path.
Exploiting it required nothing beyond a permission every domain user already has by default: the ability to modify one’s own User Principal Name. An attacker sets their own UPN to match a target’s SamAccountName — a Domain Admin’s, for instance — which Active Directory allows because the two strings aren’t technically identical. Requesting a ticket for password-change purposes using that UPN and the attacker’s own password returns a ticket that is, cryptographically, still tied to the attacker’s account, but bears the target administrator’s name. That ticket is enough to change the target’s password outright, with no need to know the original. The only real precondition is that the target’s password must be older than Active Directory’s default one-day minimum age — a threshold nearly every account clears. Researcher Andrea Pierini contributed a further refinement, showing the technique can be paired with the Shadow Credentials method for a stealthier attack path through writable computer accounts. Semperis subsequently published an open-source PowerShell tool, ResetNightmare, that automates the full attack chain.
Detection and response. Semperis customers running its Directory Services Protector platform gain new indicators covering disabled uniqueness checks, hidden Unicode characters in directory objects, and unauthorized SPN or UPN writes. For organizations without that tooling, Semperis recommends enabling SACL auditing on domain controllers: Windows Security Event ID 5136 will log the addition of a conflicting SPN (evidence of KerberLoss) or a UPN matching another account’s SamAccountName (evidence of ResetNightmare).
Disclosure and patch status. Semperis reported KerberLoss to Microsoft’s Security Response Center on November 26, 2025, and ResetNightmare on December 17, 2025; both were confirmed in January 2026. Microsoft shipped fixes through its regular Patch Tuesday cycle — KerberLoss on March 10 and ResetNightmare on April 14 — rating both “Important” rather than “Critical,” a classification Semperis warns can cause organizations that triage strictly by severity to overlook the updates. Beyond patching every domain controller, Semperis recommends auditing which accounts hold WriteSPN or unnecessary delegation rights and applying the principle of least privilege to reduce the blast radius even on unpatched systems.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de