CWE-285

Windows Kerberos — ResetNightmare: Arbitrary Password Reset via Change Password Protocol Validation Flaw (CVE-2026-27912)

CVE-2026-27912, nicknamed ResetNightmare by Semperis, is a validation flaw in the Kerberos Change Password protocol that allows an attacker to reset the password of any user or computer account in Active Directory — including Domain Admins, the krbtgt…