Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Authenticate as low-privilege domain user
  2. Delivery
    Send crafted LDAP Compare with injected attribute
  3. Exploit
    Bypass ACL via trusted-context search
  4. Install
    Disclose msKds-RootKeyData attribute
  5. C2
    Derive gMSA passwords offline
  6. Execute
    Authenticate as privileged gMSA
  7. Impact
    Compromise domain

Vulnerability Assessment

Weakness
CWE
CWE-90
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization LDAP query parameterization
MITRE ATT&CK

1 technique across 1 tactic: Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires an authenticated low-privilege domain account (CVSS PR:L) that can reach the Samba AD DC's LDAP service over the network; no user interaction and no elevated privileges are needed to trigger the disclosure. The specific high-impact path - offline derivation of gMSA passwords via the msKds-RootKeyData attribute - is limited to deployments that actually run Samba in the AD DC role AND have Group Managed Service Accounts configured, ideally privileged ones for maximum impact; environments without gMSAs still suffer confidential-attribute disclosure but not the direct gMSA-to-domain-compromise chain. Limiting factors: attacker must already hold valid domain credentials, and full domain compromise depends on privileged gMSAs being present.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction - realistic for any environment where ordinary domain users authenticate to a DC. The I:H/A:H metrics reflect the downstream gMSA-to-domain-compromise chain rather than direct write/DoS from the LDAP Compare bug itself, which is primarily a confidentiality (disclosure) issue; defenders should read the high integrity/availability weighting as 'can lead to' full compromise, not immediate tampering. No EPSS score, SSVC decision, or POC was provided, and the CVE is not in CISA KEV, so there is no evidence of active or automatable mass exploitation at this time. Net assessment: a genuinely high-priority patch - the prerequisites (a single valid domain account) are trivially met in real AD environments and the impact ceiling is domain takeover - but the concrete worst case (offline gMSA password derivation) applies specifically to deployments that actually use gMSAs. Missing signal: EPSS and any exploitation telemetry are absent, so likelihood is inferred from ease-of-attack, not observed activity.
Exploit ScenarioDerived

An attacker who has compromised or been issued any ordinary domain account authenticates to a Samba AD DC and issues crafted LDAP Compare requests with injected attribute names, causing the server to evaluate them in a trusted context and leak attributes the account should not see. In a gMSA-using domain the attacker reads msKds-RootKeyData, derives the passwords of privileged Group Managed Service Accounts offline, and reuses them to escalate toward domain compromise. No public exploit code was identified, but the attack requires only low complexity and a single valid credential.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.

RemediationAI

Patch available per vendor advisory - apply the updated Samba packages from your distribution: Red Hat customers should follow access.redhat.com/security/cve/CVE-2026-58222 (tracking bug bugzilla.redhat.com/show_bug.cgi?id=2502722) and Ubuntu users should install the update from USN-8621-1 (ubuntu.com/security/notices/USN-8621-1); refer to the upstream Samba advisory at www.samba.org/samba/security/CVE-2026-58222.html for source builds. Exact fixed version strings are not included in the provided data, so pull the precise patched build from your distributor's advisory rather than assuming a number. Because a patch exists, upgrading is the correct primary action; if patching must be delayed, compensating controls include rotating the gMSA KDS root key and rotating/retiring privileged gMSA accounts after patching (offline-derived passwords remain valid until the underlying key material changes), and tightening which accounts can bind to the DC - note that restricting low-privilege LDAP access is difficult in AD because all domain users must authenticate, so network-level segmentation of DC LDAP ports (389/636) to trusted management ranges is only a partial mitigation and can break legitimate clients. Monitoring for anomalous LDAP Compare volume against sensitive attributes is a detection stopgap, not a fix.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw resides in Samba's AD DC LDAP server, which implements the LDAP directory protocol backed by an internal database (LDB). LDAP Compare operations test whether an attribute holds a given value; here Samba does not properly validate the attribute name supplied by the client before constructing and executing the internal search, and it performs that search in a trusted/system context rather than the caller's security context. This is a classic CWE-90 LDAP Injection combined with an authorization (ACL) bypass: the security descriptors that normally gate which attributes a low-privileged principal may read are not applied. The most damaging target is msKds-RootKeyData, the KDS root key used by the Group Managed Service Account (gMSA) subsystem - once an attacker reads this normally SYSTEM-only attribute, gMSA passwords can be recomputed offline using the documented gMSA key-derivation scheme. The affected CPEs enumerate Red Hat products (RHEL 6 through 10 and OpenShift Container Platform 4) because those distributions ship the vulnerable Samba packages; the underlying vulnerable component is Samba itself as tracked upstream (bugzilla.samba.org #16148).

Know when LDAP gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.5 MEDIUM

Authenticated domain user (PR:L) over the network (AV:N/AC:L) directly gains attribute disclosure (C:H); integrity/availability impact is a downstream gMSA-chaining consequence, not direct, so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

Executive ViewAI

Why It Matters

Samba's Active Directory Domain Controller contains an LDAP filter injection vulnerability (CVE-2026-58222, CVSS 8.8) that allows any domain user to read protected directory attributes, including Group Managed Service Account (gMSA) password material. In environments where gMSA is enabled, this can lead to offline password cracking and full domain compromise. Organizations running Samba AD DC should prioritize patching immediately.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.8%
Top 46% exploitable
Prevalence
High
Samba is widely deployed; AD DC role common in enterprise Linux directories
Social Media
2
Sightings
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.8%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in LDAP

View all
CVE-2016-9299 CRITICAL POC
9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
CVE-2017-14596 CRITICAL POC
9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL POC
9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2026-15723 HIGH POC
8.2 Oct 21

An authenticated GitLab user can seize control of an existing LDAP-backed account on instances that have both OmniAuth S
CVE-2026-11748 MEDIUM POC
6.9 Jun 22

LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to a
CVE-2023-28853 MEDIUM POC
6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
CVE-2020-36966 MEDIUM POC
6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
CVE-2025-36556 MEDIUM POC
6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
CVE-2026-23906 CRITICAL
9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
CVE-2026-44930 CRITICAL
9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
CVE-2024-33868 CRITICAL
9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2023-6905 CRITICAL
9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/samba-client:latest Container suse/samba-toolbox:latest Affected
Container suse/samba-server:latest Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP7-BYOS-EC2 Affected
SUSE Enterprise Storage 7.1 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58222 ADVISORY https://ubuntu.com/security/notices/USN-8621-1 ADVISORY https://vuldb.com/vuln/384842 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22977/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3362/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3363/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3364/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3365/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3366/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3367/ REF https://access.redhat.com/security/cve/CVE-2026-58222 REF https://bugzilla.redhat.com/show_bug.cgi?id=2502722 REF https://bugzilla.samba.org/show_bug.cgi?id=16148 REF https://www.samba.org/samba/security/CVE-2026-58222.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy