Potential ResetNightmare UPN Set to Bare SamAccountName (CVE-2026-27912)

Georgios Maragos@Gmarak

•updated Aug 14, 2026•4•0•16

Detects modifications to the 'userPrincipalName' attribute in Active Directory via Security Event ID 5136 where the assigned value lacks an '@' character. This behavior is indicative of the ResetNightmare exploitation technique (CVE-2026-27912), which involves setting the UPN to a bare sAMAccountName to facilitate unauthorized password resets or account takeover.