Notifications
Clear all
Topic starter
27/08/2026 2:11 pm
TL;DR: Two Active Directory flaws, ResetNightmare and KerberLoss, can let attackers confuse usernames and service names, weaken authentication, disrupt services, and potentially reach full domain compromise, according to Semperis in the company’s August 2026 disclosure. The lesson is that identity systems themselves are a security boundary, and name-validation failures can become privilege-escalation paths.
NHIMG editorial — based on content published by Semperis: ResetNightmare and KerberLoss identity confusion vulnerabilities in Active Directory
Questions worth separating out
Q: What breaks when Active Directory names can be manipulated?
A: Authentication, service binding, and privilege decisions can all be steered toward the wrong account when directory names are ambiguous or deceptive.
Q: Why do directory validation flaws matter to IAM teams?
A: IAM depends on the directory as a source of truth for who or what is being authorized.
Q: How do organisations know if AD identity manipulation is happening?
A: Look for suspicious directory changes, unusual principal renames, service object edits, and mismatches between how an object should resolve and how it is actually being used.
Practitioner guidance
- Harden directory name validation Block ambiguous Unicode and similar-looking object names in Active Directory, including service names and administrative principals, so attackers cannot create visually deceptive identities.
- Tune auditing for directory manipulation Monitor Security Event ID 5136 and related directory-change telemetry for unexpected principal renames, service object edits, and identity-binding changes.
- Review fallback authentication behaviour Check where services downgrade to weaker authentication or alternate bindings when name resolution fails or conflicts, then remove fail-open behaviour wherever possible.
What's in the full analysis
Semperis' full analysis covers the operational detail this post intentionally leaves for the source:
- Technical context on the ResetNightmare and KerberLoss exploit mechanics, including the Active Directory naming conditions that make the flaws possible.
- The specific directory change patterns defenders can hunt for alongside Security Event ID 5136 in real environments.
- Microsoft patch timing and severity context for both vulnerabilities, useful for internal remediation prioritisation.
- Semperis' presentation context from Black Hat and DEF CON, which helps practitioners map the research to current adversary attention.
👉 Read Semperis' analysis of the ResetNightmare and KerberLoss vulnerabilities →
Active Directory name confusion and domain takeover risk: are your controls ready?
Explore further
27/08/2026 2:12 pm
Identity confusion is a control failure, not just a directory bug. These vulnerabilities work because AD is trusted to interpret names consistently across humans, services, and access logic. Once that interpretation can be manipulated, the directory stops being a reliable source of authorization truth. The practical conclusion is that identity systems must be governed as enforcement infrastructure, not treated as passive registries.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when AD confusion leads to domain compromise?
A: Accountability sits with the identity and directory owners, because they control naming rules, validation, auditing, and escalation boundaries. NIST CSF, NIST SP 800-53, and privileged access governance all point to the same issue: if identity integrity is a trust boundary, it needs explicit ownership and monitoring.
👉 Read our full editorial: Active Directory identity confusion raises domain takeover risk
