A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100780 advisory.

    A security flaw combining LDAP filter injection and improper authorization checks was found in Samba     Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly     validate user-supplied attribute names and executes the resulting internal database search in a trusted     context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain     user can exploit these flaws to disclose confidential Active Directory attributes that would normally be     inaccessible. The disclosed information may be leveraged to derive sensitive authentication material,     potentially leading to privilege escalation and complete domain compromise. For example: In deployments     configured with Group Managed Service Accounts (gMSAs), an attacker can extract the msKds-RootKeyData     attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if     privileged gMSAs are present.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0811 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-58222:
    A security flaw combining LDAP filter injection and improper authorization checks was found in Samba     Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly     validate user-supplied attribute names and executes the resulting internal database search in a trusted     context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain     user can exploit these flaws to disclose confidential Active Directory attributes that would normally be     inaccessible. The disclosed information may be leveraged to derive sensitive authentication material,     potentially leading to privilege escalation and complete domain compromise.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the samba package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21540-1 advisory.

    Update to 4.22.11.

    Security issues fixed:

    - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the       `user.SmbReparse` xattr (bsc#1261188).
    - CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user     with       write access (bsc#1261158).
    - CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification     (bsc#1261159).
    - CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code     can lead       to crash via crafted UDP packet (bsc#1261160).
    - CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server     (bsc#1261163).
    - CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing     subsystem       (bsc#1261161).
    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

    Other updates and bugfixes:

    - `samba-tool`: do not complain of no subcommand with `-V` (bsc#1273189, bso#15770).
    - Add `python3-cryptography` and `python3-requests` requirements for `samba-python3`.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-8e7fa96cf3 advisory.

    Update to Samba 4.23.10 (and rebuild of FreeIPA).
    Security fixes for CVE-2026-6949, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222, CVE-2026-58216 and     CVE-2026-58224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-fcd4630c0d advisory.

    Update to Samba 4.24.5 (and rebuild of FreeIPA)     Security fixes for CVE-2026-6949, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222, CVE-2026-58216 and     CVE-2026-58224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-3be8175017 advisory.

    Update to Samba 4.24.5 (and rebuild of FreeIPA)     Security fixes for CVE-2026-6949, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222, CVE-2026-58216 and     CVE-2026-58224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21475-1 advisory.

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.22.11 / 4.24.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-209-03 advisory.

    New samba packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3367-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3362-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3364-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3363-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3365-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A security flaw combining LDAP filter injection and improper authorization checks was found in Samba     Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly     validate user-supplied attribute names and executes the resulting internal database search in a trusted     context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain     user can exploit these flaws to disclose confidential Active Directory attributes that would normally be     inaccessible. The disclosed information may be leveraged to derive sensitive authentication material,     potentially leading to privilege escalation and complete domain compromise. For example: In deployments     configured with Group Managed Service Accounts (gMSAs), an attacker can extract the msKds-RootKeyData     attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if     privileged gMSAs are present. (CVE-2026-58222)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6401 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6401-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 28, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : samba     CVE ID         : CVE-2026-6949 CVE-2026-58216 CVE-2026-58218 CVE-2026-58221                      CVE-2026-58222 CVE-2026-58224

    Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,     print, and login server for Unix, which might result in denial of     service, domain takeover, information disclosure or privilege     escalation.

    For the stable distribution (trixie), these problems have been fixed in     version 2:4.22.10+dfsg-0+deb13u2.

    We recommend that you upgrade your samba packages.

    For the detailed security status of samba please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
336546	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: samba (UTSA-2026-100780)	Nessus	Unity Linux Local Security Checks	Local	high
334820	TencentOS Server 4: samba (TSSA-2026:0811)	Nessus	Tencent Local Security Checks	Local	high
334714	Photon OS 5.0: Samba PHSA-2026-5.0-92-0948	Nessus	PhotonOS Local Security Checks	Local	high
333510	openSUSE 16: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (openSUSE-SU-2026:21540-1)	Nessus	SuSE Local Security Checks	Local	critical
333275	Fedora 43 : freeipa / samba (2026-8e7fa96cf3)	Nessus	Fedora Local Security Checks	Local	high
333154	Fedora 44 : freeipa / samba (2026-fcd4630c0d)	Nessus	Fedora Local Security Checks	Local	high
331944	Fedora 45 : freeipa / samba (2026-3be8175017)	Nessus	Fedora Local Security Checks	Local	high
331556	openSUSE 16: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (openSUSE-SU-2026:21475-1)	Nessus	SuSE Local Security Checks	Local	high
330587	Slackware Linux 15.0 / current samba Multiple Vulnerabilities (SSA:2026-209-03)	Nessus	Slackware Local Security Checks	Local	high
330563	SUSE SLES12: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3367-1)	Nessus	SuSE Local Security Checks	Local	high
330560	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3362-1)	Nessus	SuSE Local Security Checks	Local	high
330553	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3364-1)	Nessus	SuSE Local Security Checks	Local	high
330549	SUSE SLED15: ctdb / ldb-tools / libldb-devel / libldb2 / libldb2-32bit / etc (SUSE-SU-2026:3363-1)	Nessus	SuSE Local Security Checks	Local	high
330538	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3365-1)	Nessus	SuSE Local Security Checks	Local	high
330477	Linux Distros Unpatched Vulnerability : CVE-2026-58222	Nessus	Misc.	Local	high
330422	Debian dsa-6401 : ctdb - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-58222

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high