ResetNightmare (CVE-2026-27912)

Exploits an unpatched Windows Kerberos change-password validation flaw (CVE-2026-27912): set a controlled account's UPN to the target's sAMAccountName, request a TGT for that name with NT-ENTERPRISE using the controlled account's credentials, clear the spoofed UPN, then use the ticket through kadmin/changepw to set the target password. It requires UPN-write on the controlled account (or permission to create a controlled account in a delegated OU) and a target password old enough to satisfy domain minimum-age policy. The steps show the Linux command route; the ResetNightmare PowerShell PoC and NetExec module automate the same flow.