Vulnerability intelligence

CVE-2026-3012

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

CVSS Score

High

EPSS — Exploit Probability

0.3%

Riskier than 18% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered May 29, 2026 · latest May 29, 2026

Coverage timeline

Samba Fixes Multiple Flaws with Maximum 10.0 CVSS Scores
securityonline.info · May 29, 2026