CVE-2026-3012
⚠️ highSummary
A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.
CVSS Score
8.0
High
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-27
First Seen: 2026-05-28
📊 Relative Risk Intelligence
This CVE is High Risk - more severe than 77.5% of all 326,604 vulnerabilities in our database.
#73,427
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 27, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Red Hat would like to thank Arad Inbar (DREAM Security Research Team), Ben Grinberg (DREAM Security Research Team), Michalis Vasileiadis, and Nir Somech (DREAM Security Research Team) for reporting this issue.
SSVC data provided by
CISA
Last Modified
2026-06-08
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE IDs (Weakness Types)