Is CVE-2026-3012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3012 being exploited in the wild.

How severe is CVE-2026-3012?

High severity, with a CVSS score of 8, published 27 May 2026.

Is there a fix for CVE-2026-3012?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-3012 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-3012?

Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3012: Samba certificate auto-enrollment improper validation in Group Policy

CVE-2026-3012 · Severity: high · CVSS 8 · Published 2026-05-27

A vulnerability in Samba's certificate auto-enrollment feature could allow an attacker on the same network to intercept or spoof secure communications. When a Linux computer joins a Windows domain, Samba may download security certificates over an unencrypted connection without verifying them. This allows an attacker to install a malicious certificate authority on the system, potentially gaining persistent access to encrypted data or impersonating trusted services.

Technologies: Samba. Vendors: Samba.

Quick answers

Is CVE-2026-3012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3012 being exploited in the wild.
How severe is CVE-2026-3012?: High severity, with a CVSS score of 8, published 27 May 2026.
Which products and versions are affected?: Samba 4.1 and newer.
Is there a fix for CVE-2026-3012?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3012 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-3012?: Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Samba Group Policy certificate auto-enrollment extension (`gp_cert_auto_enroll_ext.py`). When processing certificate enrollment, the component fetches a Certificate Authority (CA) certificate via SCEP over plain HTTP and installs it into the system-wide trust store (e.g., `/usr/local/share/ca-certificates/`) without validating it against the trusted `cACertificate` already obtained via Kerberos-authenticated LDAP. An attacker capable of intercepting or redirecting network traffic (Machine-in-the-Middle) can provide a rogue CA certificate. This rogue certificate is then trusted by the system, allowing the attacker to intercept or spoof TLS traffic. The issue affects Samba versions 4.1 and newer when Group Policy is enabled. Patches have been developed to prioritize LDAP-provided certificates or enforce validation.

Affected products

Samba Samba 4.1 and newer

Timeline

2026-02-17: disclosed: Reported to Samba by DREAM Security Research Team
2026-05-27: advisory: Public disclosure of CVE-2026-3012

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.