CVE-2026-58222: Samba Active Directory LDAP Attribute Disclosure Bug - What It Means for Your Business and How to Respond

Introduction

A newly disclosed vulnerability in Samba Active Directory Domain Controllers poses a serious risk to organizations that rely on Samba for identity and access management. CVE-2026-58222 allows an ordinary authenticated domain user to access confidential Active Directory attributes that should remain protected. In environments using Group Managed Service Accounts, this can escalate into full domain compromise.

Businesses running Samba as an Active Directory Domain Controller face potential disruption to operations, exposure of sensitive credentials, regulatory scrutiny, and reputational harm. This post explains why the issue matters, who is most at risk, the practical business consequences, and the concrete steps you should take. Technical details appear only in the appendix for security and IT professionals.

Background & History

CVE-2026-58222 was publicly disclosed on July 28, 2026, as part of coordinated Samba security releases. The vulnerability affects Samba Active Directory Domain Controller installations starting from version 4.0.0. It was originally reported by OpenAI Security Research, with additional findings from Andrew Tridgell of the Samba Team and Tristan Madani of Talence Security. Patches were developed by Stefan Metzmacher.

The issue carries a CVSS score of 8.8 (High). In plain language, it combines weak validation of user-supplied data in LDAP Compare requests with improper enforcement of access controls. An authenticated low-privilege user can force disclosure of confidential attributes that normal searches would hide. Severity rises to Critical when the disclosed data includes Group Key Distribution Service root keys, enabling offline derivation of privileged service account passwords.

Samba issued security releases for the 4.24.x, 4.23.x, and 4.22.x branches on the same day. No workarounds exist; patching is the only reliable fix. Standard Red Hat Enterprise Linux file-server or domain-member installations are not affected because they do not support the AD DC role.

What This Means for Your Business

If your organization uses Samba as an Active Directory Domain Controller, this vulnerability directly threatens the confidentiality and integrity of your identity infrastructure. An attacker who already has a low-privilege domain account can extract sensitive authentication material. In environments that use Group Managed Service Accounts, the attacker may derive passwords offline and gain the same privileges as those service accounts. When those accounts hold elevated rights, complete domain takeover becomes possible.

Operational impact includes potential loss of control over user authentication, file shares, and group policies. Data risk centers on exposure of secrets that protect other systems and applications. Reputation damage follows if a compromise leads to broader network intrusion or data breach notifications. Compliance obligations under frameworks that require protection of authentication credentials and access controls may be triggered, increasing audit and legal exposure.

Because the attack requires only an authenticated low-privilege user and network access to the domain controller, the barrier is relatively low once an account is compromised through phishing, credential theft, or insider activity. Prompt assessment and remediation are essential to limit exposure.

Real-World Examples

Regional Financial Institution: A mid-sized bank running Samba AD DC for internal authentication experiences credential theft of a standard employee account. The attacker uses the vulnerability to extract Group Managed Service Account material, escalates privileges, and gains access to transaction systems, triggering regulatory reporting and customer notification requirements.

Healthcare Provider Network: A multi-clinic organization relies on Samba for domain services supporting electronic health record access. A compromised staff account allows disclosure of protected attributes, enabling lateral movement that risks exposure of patient data and violates privacy regulations.

Manufacturing Firm: A mid-market manufacturer with Samba-based domain controllers for production floor systems suffers an insider or phishing-related account compromise. The attacker reconstructs sensitive keys, disrupts production authentication, and forces costly downtime while identity services are rebuilt.

Municipal Government Office: A local government entity using Samba AD DC for employee and contractor access sees a low-privilege account leveraged to obtain elevated credentials, potentially exposing citizen data systems and triggering public transparency and audit obligations.

Am I Affected?

• You operate one or more Samba Active Directory Domain Controllers (the AD DC role).
• Your Samba version is 4.0.0 or later and has not been updated to a patched release in the 4.22.x, 4.23.x, or 4.24.x security branches (or equivalent vendor packages).
• You use or plan to use Group Managed Service Accounts on Samba 4.21.0 or later.
• Standard domain users or low-privilege accounts can reach the domain controller over the network.
• You are not running Samba solely as a file server, print server, or domain member (those configurations are typically unaffected).

If any of the first three items apply, treat the environment as potentially exposed until versions are confirmed and patched.

Key Takeaways

• CVE-2026-58222 allows authenticated low-privilege users on Samba Active Directory Domain Controllers to disclose confidential attributes that can lead to privilege escalation and domain compromise.
• Organizations relying on Samba for core identity services face operational disruption, credential exposure, compliance risk, and reputational harm.
• No workarounds exist; the only reliable path is to apply the official security updates released on July 28, 2026.
• Immediate inventory of Samba AD DC instances and confirmation of patched versions are the highest-priority business actions.
• Environments using Group Managed Service Accounts face elevated risk of complete domain takeover if root key material is disclosed.

Call to Action

Protecting your Active Directory infrastructure requires more than applying a single patch. IntegSec helps organizations identify exposure, validate controls, and reduce residual risk through targeted penetration testing and advisory services. Contact us today at https://integsec.com to schedule an assessment focused on identity systems and Active Directory resilience. Act now to close this gap before it is exploited.

TECHNICAL APPENDIX
(For security engineers, pentesters, and IT professionals only)

A — Technical Analysis

The root cause combines two flaws in Samba’s LDAP CompareRequest handling on Active Directory Domain Controllers. First, user-supplied attribute names and assertion values are inserted into an LDB filter string via talloc_asprintf without proper validation or escaping, enabling filter injection (for example, by appending comparison operators). Second, the resulting internal database search executes in a trusted context rather than an untrusted one, so the ACL read module does not enforce normal visibility restrictions on confidential attributes.

An authenticated low-privilege domain user can therefore issue crafted Compare requests that function as a binary-search oracle, reconstructing protected attribute values that standard LDAP searches redact. A primary target is the msKds-RootKeyData attribute used by the Group Key Distribution Service. On Samba 4.21.0 and later with gMSAs enabled, offline derivation of gMSA passwords becomes feasible and can yield domain compromise if privileged gMSAs exist.

Attack vector is network (LDAP). Attack complexity is low. Privileges required are low. User interaction is none. Scope is unchanged. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8). CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query). Official references include the Samba security announcement and Red Hat CVE page.

B — Detection & Verification

Version enumeration:
samba -V or package manager queries (rpm -q samba, dpkg -l samba, etc.) to confirm whether the installed AD DC packages predate the July 28, 2026 security releases (4.22.11 / 4.23.10 / 4.24.5 or vendor equivalents).

Scanner signatures: Vulnerability scanners that check Samba version against known fixed releases will flag unpatched AD DC instances. Custom checks can look for the presence of the AD DC role (samba-tool domain info or equivalent).

Log indicators: Elevated LDAP Compare activity from low-privilege accounts, especially sequences of inequality comparisons against sensitive attributes, may appear in Samba or directory service logs. Enable and review dsdb-related audit logging where available.

Behavioral anomalies: Unusual volume of LDAP Compare requests, particularly those targeting msKds-RootKeyData or other confidential attributes, from non-administrative accounts.

Network exploitation indicators: LDAP traffic containing CompareRequest PDUs with malformed or operator-injected attribute names originating from authenticated sessions.

C — Mitigation & Remediation

1. Immediate (0–24h): Inventory all Samba Active Directory Domain Controllers. Confirm versions. Apply the official security updates (Samba 4.24.5 / 4.23.10 / 4.22.11 or downstream vendor packages) as soon as testing permits. Restrict network access to domain controllers to only necessary management and authentication traffic where possible.
2. Short-term (1–7d): Validate that patches are fully applied and services restarted. Review Group Managed Service Account usage and rotate any credentials that may have been exposed. Audit recent LDAP activity and privileged account usage. Confirm no residual low-privilege accounts retain unnecessary access to the domain controllers.
3. Long-term (ongoing): Maintain a rigorous patch cadence for Samba AD DC instances. Prefer upstream or distribution security releases promptly after disclosure. Segment domain controllers, enforce least-privilege for domain accounts, and monitor LDAP traffic for anomalous Compare patterns. There are no effective long-term workarounds; patching remains mandatory.

Official vendor patches take precedence. Environments that cannot patch immediately should isolate the AD DC role as far as operationally feasible and accelerate testing of the security releases.

D — Best Practices

• Apply Samba security updates for Active Directory Domain Controllers without delay after coordinated disclosure.
• Enforce strict least-privilege on all domain accounts and regularly review Group Managed Service Account privileges.
• Restrict LDAP access to domain controllers to authenticated and authorized sources only.
• Enable and monitor directory service audit logging for unusual Compare request patterns.
• Maintain an accurate inventory of identity infrastructure components and their patch status as part of continuous risk management.