CVE-2026-58222

Name of the Vulnerable Software and Affected Versions Samba Active Directory Domain Controller (AD DC) (affected versions not specified)

Description An issue combining LDAP filter injection and improper authorization checks exists when processing LDAP Compare requests. The software fails to properly validate user-supplied attribute names, executing internal database searches in a trusted context and bypassing Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit this to disclose confidential Active Directory attributes, such as msKds-RootKeyData. This information can be used to derive Group Managed Service Accounts (gMSAs) passwords offline, potentially leading to privilege escalation and complete domain compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.