CVE-2026-58222Patch

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-90

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-07-28); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Patch

266.7%

Disclosure

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-28	1	Patch1
2026-09-09	1	Patch1
2026-10-17	1	Disclosure1

Full discourse3 posts

hackyboiz@hackyboiz211d
Disclosure
[1day1line] CVE-2026-58222: LDAP Compare ACL Bypass in Samba AD Hello, this is millet. Today's 1day1line covers an Information Disclosure vulnerability in Samba Active Directory Domain Controller caused by LDAP Injection and improper access control during LDAP Compare operations. This vulnerability allows a low-privileged domain user to recover confidential attributes, including msKds-RootKeyData, through repeated LDAP Compare requests. The recovered KDS Root Key can then be used to derive gMSA passwords, potentially leading to domain compromise. Please refer to the blog post for more details! https://hackyboiz.github.io/2026/10/17/millet/cve-2026-58222/
Post summary
The text announces CVE-2026-58222, an Information Disclosure vulnerability in Samba AD DC involving LDAP Injection and improper access control on LDAP Compare operations, with technical details on how a low-privileged domain user could recover msKds-RootKeyData to derive gMSA passwords, referencing a blog post for further information.
020135567
588 followersView on X
Autumn Good@autumn_good_3592d
Patch
Sambaで6件の脆弱性FIX CVE-2026-6949 CVE-2026-58216 CVE-2026-58218 CVE-2026-58221 CVE-2026-58222 CVE-2026-58224 Samba - Security Updates and Information https://www.samba.org/samba/history/security.html
Post summary
Samba announces the release of patches for six CVEs, directing users to its security updates page for details.
00011408
7.0K followersView on X
IntegSec@integ_sec49d
Patch
CVE-2026-58222: Samba Active Directory LDAP Attribute Disclosure Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04x0V1b0
Post summary
The article reveals the Samba LDAP attribute disclosure CVE‑2026‑58222 and advises how to respond, yet it offers no exploit details or evidence of active attacks.
0000030
35 followersView on X

Explore more

Back to dashboard