Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover

Two newly discovered Active Directory vulnerabilities—KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912)—enable attackers with low privileges to exploit invisible Unicode characters, bypass critical uniqueness checks, and escalate to full domain takeover or cause widespread authentication disruption.