Microsoft patches two critical Active Directory flaws

Semperis researchers have identified two critical Active Directory vulnerabilities, ResetNightmare and KerberLoss. Microsoft has issued patches for both flaws.

The vulnerabilities affect how Microsoft Active Directory interprets usernames and service names, creating a path for attackers to escalate privileges and interfere with authentication.

According to Semperis, the flaws could let an attacker make two different accounts or services appear to share the same name. This confusion could disrupt access to business systems, force some services to fall back to a weaker authentication method, or allow an attacker to impersonate a privileged user.

Researchers described ResetNightmare as the more serious issue because, under certain conditions, it could let a low-privileged attacker take control of an entire Active Directory domain. KerberLoss offers a separate route to abuse weaknesses in identity handling within the directory service.

Active Directory remains central to many corporate networks, managing user identities, access rights, and relationships between systems. Semperis said it is still used in roughly 90% of enterprise environments, making any weakness in the platform significant for large organisations.

The findings come amid continued concern over identity systems as an entry point for ransomware attacks and account compromise. The Australian Signals Directorate has previously warned that Microsoft Active Directory is routinely targeted in breaches because compromised accounts can be used to gain administrator-level access and move laterally across enterprise networks.

Semperis said the two vulnerabilities exploit hidden Unicode characters and weaknesses in Active Directory name validation. In practice, an attacker may be able to manipulate how the directory distinguishes between legitimate users, service accounts, and privileged identities.

Microsoft classified both issues as Important Elevation of Privilege vulnerabilities in its severity system. It patched KerberLoss in March and ResetNightmare in April, giving organisations a clear remediation path if they have applied the updates and reviewed their directory environments.

Researchers also pointed to Active Directory auditing as a way to spot suspicious changes after patching. Security Event ID 5136 can help security teams identify unusual directory modifications that may indicate attempts to exploit naming confusion or alter critical settings.

Identity risk

The disclosure underlines a broader challenge for defenders: attackers do not always need stolen administrator passwords if they can interfere with the systems that decide which identities are trusted. That makes directory integrity as important as endpoint or network protection in enterprise security programs.

For Australian organisations, the issue carries particular weight because Active Directory often sits at the centre of internal access control. If an attacker gains domain administrator privileges, they can often control user access, deploy malicious software, alter policies, and maintain persistence across servers and workstations.

The researchers said the flaws could support a range of attack outcomes beyond privilege escalation, including denial of service, authentication downgrade, and domain-wide compromise, depending on the environment and how identities and services are configured.

ResetNightmare and KerberLoss also highlight the difficulty of securing legacy identity infrastructure that has grown over years of operational use. Active Directory commonly underpins email, file access, business applications, and internal administration, meaning small weaknesses in how it processes names can have broad consequences.

Shai Laron led the research at Semperis.

"Active Directory remains the crown jewel of enterprise infrastructure, and for threat actors, the holy grail is clear: gain Domain Admin privileges," said Shai Laron, security researcher at Semperis.

"This level of privilege effectively grants full control over an organisation's environment. Identity protection therefore plays an integral part in enterprise security, and organisations invest great effort in preventing threat actors from gaining access to administrators' credentials," Laron said.

Semperis said the research shows how small inconsistencies in identity processing can create outsized security risks. That is especially relevant for companies that assume strong password policies alone are enough to protect administrative control.

Tomer Bar, a senior member of the company's research team, said the findings extend beyond two individual software bugs and point to a class of identity-based security problems that defenders need to monitor closely.

"Shai's exceptional discovery of the ResetNightmare and KerberLoss Active Directory vulnerabilities reveals how subtle identity confusion in AD can lead to authentication downgrade, denial-of-service, and even full domain takeover," said Tomer Bar, AVP of security research at Semperis.

"His work gives defenders critical insight into emerging identity threats and helps organisations strengthen their environments before attackers can exploit them," Bar said.