# CVE-2026-12249: Canonical ADSys trust store poisoning in AD CS auto-enrollment

Source: https://junglewise.ai/threats/cve-2026-12249-canonical-adsys-trust-store-poisoning-in-ad-cs-auto-enrollment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-12249 · Severity: critical · CVSS 9 · Published 2026-06-22

Canonical ADSys, a tool used to manage Ubuntu systems within an Active Directory environment, contains a security flaw in how it handles digital certificates. During the automatic enrollment process, the system uses an insecure connection to download certificate authority (CA) data, allowing an attacker on the same network to intercept the request and insert their own malicious certificate. If exploited, this allows an attacker to bypass encryption (TLS) for the entire system, potentially leading to the theft of sensitive data or persistent monitoring of all network traffic.

Technologies: [Canonical Ubuntu](https://junglewise.ai/threats/technologies/ubuntu). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-12249 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12249 being exploited in the wild.

**How severe is CVE-2026-12249?** Critical severity, with a CVSS score of 9, published 22 June 2026.

**Which products and versions are affected?** Canonical ADSys through v0.16.2; Canonical Ubuntu versions before 0.16.3~22.04.2ubuntu0.22.04.1; github.com/ubuntu/adsys (Go) < 0.16.3-0.20250318112551-8b1939f96d38, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.16.3-0.20250318112551-8b1939f96d38.

**Is there a fix for CVE-2026-12249?** Yes. github.com/ubuntu/adsys (Go): upgrade to 0.16.3-0.20250318112551-8b1939f96d38 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12249 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-12249?** Check whether you run Canonical ADSys, Canonical Ubuntu or github.com/ubuntu/adsys (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/ubuntu/adsys (Go): upgrade to 0.16.3-0.20250318112551-8b1939f96d38 or later

  ```sh
  go get github.com/ubuntu/adsys@v0.16.3-0.20250318112551-8b1939f96d38
  ```


## Technical details

A vulnerability in Canonical ADSys upstream versions through v0.16.2 arises from the use of plaintext HTTP (http://) instead of HTTPS when requesting CA certificates from an AD CS server via the 'GetCACert' function. This occurs within the vendored Samba client script located at 'gp_cert_auto_enroll_ext.py'. An unauthenticated network attacker in a Man-in-the-Middle position can intercept this request and provide a rogue Root CA certificate. Because ADSys automatically registers this certificate into the local system trust store using 'update-ca-certificates', the attacker can subsequently intercept and decrypt TLS traffic from any application on the host that relies on the OS trust store. The issue is resolved in ADSys version v0.16.3.

## Affected products

- Canonical ADSys through v0.16.2
- Canonical Ubuntu 22.04 LTS versions before 0.16.3~22.04.2ubuntu0.22.04.1
- Canonical Ubuntu 24.04 LTS versions before 0.16.3~24.04.2ubuntu0.24.04.1

## Identifiers

- CVE-2026-12249
- GHSA-crm4-q7v4-c2r2
- GO-2026-6543

## Timeline

- 2026-06-22: disclosed
- 2026-06-22: advisory

## References

- [https://github.com/ubuntu](https://github.com/ubuntu)
- [https://launchpad.net/ubuntu/focal](https://launchpad.net/ubuntu/focal)
- [https://launchpad.net/ubuntu/jammy](https://launchpad.net/ubuntu/jammy)
- [https://launchpad.net/ubuntu/noble](https://launchpad.net/ubuntu/noble)
- [https://launchpad.net/ubuntu/questing](https://launchpad.net/ubuntu/questing)
- [https://launchpad.net/ubuntu/resolute](https://launchpad.net/ubuntu/resolute)
- [https://github.com/ubuntu/adsys/commit/8b1939f96d3827b4426eb06c1ced5bf317b0a99d](https://github.com/ubuntu/adsys/commit/8b1939f96d3827b4426eb06c1ced5bf317b0a99d)

## Related threats

- [APT package manager hard link reuse remote code execution](https://junglewise.ai/threats/cve-2026-109518-on-debian-ubuntu-and-derivative-linux-distributions-an-on-path)
- [Canonical snapd sandbox confinement bypass in snap-confine](https://junglewise.ai/threats/cve-2026-15226-canonical-snapd-sandbox-confinement-bypass-in-snap-confine)
- [Canonical snapd access control bypass in AppArmor configuration](https://junglewise.ai/threats/cve-2024-5300-canonical-snapd-access-control-bypass-in-apparmor-configuration)
- [Canonical ubuntu-pro-client code execution via APT source injection](https://junglewise.ai/threats/cve-2026-11386-canonical-ubuntu-pro-client-code-execution-via-apt-source)