External risk intelligence

ADSys CA Certificate Auto-Enrollment Trust Store Poisoning

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-12249

The vulnerability involves an internal Active Directory Certificate Services auto-enrollment process occurring between a managed host and an internal domain controller/CA. While the communication occurs over a network, this interaction is typically restricted to an internal corporate or organizational network, making public internet exposure of the vulnerable request path uncommon.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue in the Canonical ADSys component, specifically how it requests CA certificates, could allow an attacker to poison the system's trust store. This could lead to the acceptance of fake security certificates, enabling the interception and decryption of encrypted network traffic.

Unsecured certificate requests can be exploited.
Protects system-wide trust in secure communications.
Confirm relevance and exposure of this internal process.

Attack Path

How an attacker could exploit the issue

An attacker on the network can intercept a certificate request from a managed host to an Active Directory Certificate Services server. By supplying a malicious root CA certificate, the attacker can poison the system's trust store, leading to widespread acceptance of rogue certificates for any domain. This allows the attacker to decrypt and intercept subsequent secure connections on the affected machine.

Unauthenticated network access required.
Plaintext HTTP request intercepted.
System-wide trust store poisoning.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated network attacker to poison the system's trust store by intercepting a plaintext HTTP request for a CA certificate. When supported by the advisory, this could lead to the acceptance of rogue certificates, enabling persistent decryption and interception of subsequent TLS connections by TLS clients that rely on the operating system's trust store.

System-wide trust store poisoning.
Man-in-the-Middle attack on HTTP.
Intercept and decrypt TLS connections.

Operational Fix

Recommended remediation, mitigation, and detection steps

The potential for trust store poisoning through unauthenticated network interception points to a critical need for collaboration between platform, infrastructure, and security teams. The first practical step is to locate all instances of the affected technology, determine their business criticality and network exposure, and identify the accountable system owner. This information will inform a prioritized remediation plan.

Platform/Infra teams own the issue.
Verify AD CS CA hostname and network access.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Canonical ADSys?

ADSys is a tool from Canonical designed to integrate Ubuntu clients with Active Directory. It helps organizations manage system settings and policies across Ubuntu workstations, including the automated enrollment of security certificates through Active Directory Certificate Services (AD CS).

What does CWE-348 mean for CVE-2026-12249?

This vulnerability involves an improper validation of the origin of a request. In this case, ADSys fails to use an encrypted HTTPS connection when communicating with the CA server. Because it defaults to plaintext HTTP, it cannot verify the authenticity of the information it receives, allowing an attacker to inject a malicious certificate.

How does an attacker trigger this vulnerability?

An attacker must be positioned on the network path between the managed Ubuntu host and the internal Active Directory Certificate Services server. They intercept the plaintext HTTP request and respond with a fake Root CA certificate. The bug is not triggered if the communication is already occurring over a properly secured and authenticated network segment where interception is impossible.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is unlikely for most systems. Because the vulnerability requires intercepting traffic between a host and an internal Active Directory Certificate Services server, the path is typically restricted to internal corporate networks, making it difficult for public internet attackers to reach.

What should I do if I use ADSys?

First, identify all systems in your environment currently running ADSys versions up to v0.16.2. Coordinate with your platform and infrastructure teams to plan an update to v0.16.3, which resolves the issue by enforcing secure connections. Prioritize systems based on their role and their connectivity to the internal domain infrastructure.

References

github.com/ubuntu/adsys/commit/8b1939f96d3827b4426eb06c1ced5bf31…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.