CVE-2026-3012

MediumCVSS 6.8/10Last modified Oct 15, 2026

Description

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-301209.8remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.CVE-2026-301219.1remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.CVE-2026-30138.7Coppermine Photo Gallery in versions 1.6.09 through 1.6.27 is vulnerable to path traversal. Unauthenticated remote attacker is able to explo CVE-2026-301396.1A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows atta CVE-2026-30149.1Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Serv CVE-2026-301407.5An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/Download CVE-2026-301419.8An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function allows remote attackers to cause a denia CVE-2026-30158.8A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/formPolicyRouteConf CVE-2026-30168.8A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. The affected element is the function strcpy of the file /goform/formP2P CVE-2026-301626.1Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.CVE-2026-30177.2The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection CVE-2026-30187.5The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to,