Canonical adsys MITM Allows System Trust Store Poisoning via Insecure AD CS Enrollment (CVE-2026-12249)

Vulnerability Overview CVE ID: CVE-2026-12249 Release Date: June 22, 2026 Last Updated: June 26, 2026 Ubuntu Priority: Medium CVSS 3 Severity Score: 8.3 - High Description: A vulnerability was identified in the upstream Canonical AD Sys version v0.16.2. When performing Active Directory Certificate Services (AD CS) certificate auto-enrollment using the vendor Samba client script ( ), AD Sys uses an unencrypted HTTP connection ( ) instead of a secure HTTPS connection ( ) to request the CA certificate from the Active Directory Certificate Services server ( ). An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can perform a man-in-the-middle (MITM) attack. By intercepting the plaintext HTTP request, the attacker can supply an arbitrary, attacker-controlled root CA certificate. Since the system automatically accepts this certificate and registers it in the local system trust store, this leads to system-wide trust store poisoning via updates. Consequently, TLS clients using the operating system's trust store on the affected machines will accept malicious certificates for arbitrary domains, enabling persistent decryption and interception of subsequent TLS connections. This issue was resolved in version v0.16.3. Affected Versions Package: adsys Ubuntu Versions: - 26.04 LTS (resolute): Not affected - 25.10 (questing): Fixed in v0.16.3 - 24.04 LTS (noble): Not affected - 22.04 LTS (jammy): Not affected - 20.04 LTS (focal): Not affected Remediation Fixed Version: v0.16.3 Fix Status: Fixed in 25.10 (questing) Severity Score Details CVSS Version: CVSS v4.0 Base Score: 9.0 - Critical Base Metrics: - Attack Vector: Network - Attack Complexity: High - Attack Requirements: None - Privileges Required: None - User Interaction: None - Confidentiality Impact (Affected System): High - Integrity Impact (Affected System): High - Availability Impact (Affected System): High - Confidentality Impact (Subsequent System): High - Integrity Impact (Subsequent System): High - Availability Impact (Subsequent System): High References MITRE NVD Launchpad Debian Other References Resources Infrastructure Hardening Guide - Best practices for improving the security of Linux-based infrastructure deployments --- Note: No Proof of Concept (PoC) code or exploitation code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Canonical adsys MITM Allows System Trust Store Poisoning via Insecure AD CS Enrollment (CVE-2026-12249)