Micropatches released for "ResetNightmare" Windows Kerberos Elevation of Privilege (CVE-2026-27912)
April 2026 Windows Updates brought a patch for CVE-2026-27912, an elevation of privilege vulnerability allowing an attacker to change any domain user's password, and thereby take over the domain.
Security researcher Shai Laron with Semperis found this vulnerability and reported it to Microsoft. Shai subsequently published a detailed article and shared a proof-of-concept tool that allowed us to reproduce the issue and create patches for legacy Windows users.
The Vulnerability
The vulnerability lies in the Kerberos Change Password service on aWindows domain controller. A domain user who can modify the userPrincipalName attribute on an account they control can change the password of any other account in the domain, including domain administrator's. The root cause is in the change-password code blindly trusting the user ID (SID) to change the password for (provided by the attacker) and not validating the requestor's identity.
Microsoft's Patch
Microsoft fixed the issue by adding a security check to make sure the SID of the user for which the password change was requested matches the SID of the user making such request.
Our Patch
Our patch is logically identical to Microsoft's.
Micropatch Availability
Micropatches were written for the following security-adopted Windows versions:
Windows Server 2008 R2 - fully updated with no ESU, with ESU 1,
ESU 2*, ESU 3 or ESU 4Windows Server 2012 - fully updated with no ESU, with ESU 1 or ESU 2
Windows Server 2012 R2 - fully updated with no ESU, with ESU 1 or ESU 2
(* For some reason, Windows Server 2008 R2 with ESU2 applied is not vulnerable to this issue.)
Micropatches have already been distributed to, and applied on, all affected online computers with 0patch Agent in PRO or Enterprise accounts (unless Enterprise group settings prevented that).
New vulnerabilities like these are discovered regularly, and attackers can eventually learn about and exploit them. If you're using Windows that aren't receiving official security updates anymore, 0patch will help prevent these vulnerabilities from being exploited on your computers - and you won't even have to know or care about these things.
We'd like to thank Shai Laron with Semperis for sharing their analysis and POC, which allowed us to create patches for Windows versions that are no longer receiving official updates from Microsoft.
If you're new to 0patch, create a free account in 0patch Central, start a free trial, then install and register 0patch Agent. Everything else will happen automatically. No computer reboot will be needed.
Did you know 0patch security-adopted Windows 10 and Office 2016 and 2019 when they went out of support in October 2025, allowing you to keep using them for at least 3 more years (5 years for Windows 10)? Read more about it here and here.
Note that we will soon security-adopt the following products:
Windows 10 22H2 with Extended Security Updates year 1: October 2026
Windows Server 2012 with Extended Security Updates year 3: October 2026
Windows Server 2012 R2 with Extended Security Updates year 3: October 2026
Microsoft Office 2021: October 2026 - Read more about it here
Windows 11 23H2 (E): November 2026
Windows Server 2016: January 2027
To learn more about 0patch, please visit our Help Center.