CVE Intelligence
Analysis AI-assisted

CVE-2026-12249: Canonical ADSys plaintext HTTP CA certificate retrieval enables trust store poisoning

CVE-2026-12249 affects Canonical ADSys upstream versions through v0.16.2. During AD CS certificate auto-enrollment, the component requests the CA certificate over plaintext HTTP, which allows a network attacker in a man-in-the-middle position to inject a rogue root CA into the system trust store. The record states the issue is resolved in v0.16.3.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-12249 affects Canonical ADSys upstream versions through v0.16.2. According to the record, during AD CS certificate auto-enrollment the component fetches the CA certificate over plaintext HTTP rather than HTTPS. The record states the fix is in v0.16.3, and the Ubuntu security notice references it.

Impact

  • An attacker on the network path between the managed host and the configured AD CS CA hostname may tamper with the CA certificate response.
  • A rogue root CA could be added to the system trust store, so TLS clients on that host may accept forged certificates for arbitrary domains.
  • Subsequent TLS sessions from the affected host could be decrypted or intercepted.
  • The record assigns a CVSS 3.1 base score of 9.0 (critical) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, and a CVSS 4.0 score of 9, both supplied by the CNA.

Affected products and versions

  • Canonical ADSys, upstream versions through v0.16.2.
  • Fixed in v0.16.3 according to the record description.
  • The structured affected and fixes lists in the record are empty, so the version range is taken from the description text.

Exploitation status

  • The record shows kev.listed as false, so the CVE is not reported in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • No EPSS data is present in the record.

Remediation and mitigation

  • Update ADSys to v0.16.3 or later, as indicated in the record.
  • Review the fix commit to confirm the change to the certificate retrieval path.
  • Until patched, restrict network paths between managed hosts and AD CS servers, and limit who can intercept traffic on that segment.
  • Review the local trust store on managed hosts for unexpected root CA certificates.

Detection guidance

  • Inventory hosts running ADSys and record their versions.
  • Audit the system trust store for root certificates the organization does not expect.
  • Where network visibility allows, monitor AD CS-related traffic for plaintext HTTP requests to the CA enrollment endpoint.

Limitations of the available information

  • The record does not include CPE data, structured affected version ranges, or exact package names per distribution.
  • The record does not state whether NVD has published its own score.
  • Exploitation details and proof-of-concept availability are not described in the record.
  • Exposure of a specific deployment depends on network topology, which the record does not describe.

Frequently asked questions

What is the core problem in CVE-2026-12249?

According to the record, ADSys requests the CA certificate over plaintext HTTP during AD CS auto-enrollment, which allows a network attacker to substitute a rogue root CA that the system then trusts.

Which versions are affected?

The record describes upstream ADSys versions through v0.16.2 as affected and states that the issue is resolved in v0.16.3.

Is this CVE known to be exploited in the wild?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Update ADSys to v0.16.3 or later, restrict network paths between managed hosts and AD CS servers, and review system trust stores for unexpected root certificates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.