CVE-2026-58221samba Vulnerability
Samba AD authenticated LDAP access domain takeover.
Published Jul 28, 2026 · Updated Jul 31, 2026 · Also known as DEBIAN-CVE-2026-58221, UBUNTU-CVE-2026-58221
Key Facts
Patch in the next maintenance window- CVE-2026-58221 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting samba (alpine), ctdb (ubuntu), ldb-tools (ubuntu) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- Fixed versions are available, including ctdb 2:4.15.13+dfsg-0ubuntu1.13, ctdb 2:4.19.5+dfsg-4ubuntu9.7, ctdb 2:4.23.6+dfsg-1ubuntu2.2.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
n/a
Exploit maturity
Proof of concept
ATLAS score
34/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
Samba AD authenticated LDAP access domain takeover. Samba AD low-privilege authenticated LDAP access allows modifications to internal LDB special DNs, which permits a domain takeover.
Affected Products
509 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| sambaalpine | See advisory | 4.23.10-r0 |
| ctdbubuntu | See advisory | 2:4.15.13+dfsg-0ubuntu1.13 |
| ldb-toolsubuntu | See advisory | 2:2.8.0+samba4.19.5+dfsg-4ubuntu9.7 |
| libldb2ubuntu | See advisory | 2:2.8.0+samba4.19.5+dfsg-4ubuntu9.7 |
| libldb-devubuntu | See advisory | 2:2.8.0+samba4.19.5+dfsg-4ubuntu9.7 |
Patched Releases
ctdb
2:4.15.13+dfsg-0ubuntu1.13, 2:4.19.5+dfsg-4ubuntu9.7, 2:4.23.6+dfsg-1ubuntu2.2, 4.15.13+git.729.a8ce057e8d-3.109.1, 4.15.13+git.808.eeca19f5e1-150300.3.106.1, 4.15.13+git.808.eeca19f5e1-150400.3.52.1, 4.17.12+git.581.f49579c6cd-150500.3.42.1, 4.19.8+git.501.67274891bc-150600.3.29.1, 4.21.10+git.533.31d7e5508d-150700.3.29.1, 4.22.11+git.552.66cfeb7de0a-160000.1.1, 4.22.9+git.538.af6cb4fb2e-160000.1.1, 4.24.5+git.481.dba78dbdea-1.1
ctdb-pcp-pmda
4.22.11+git.552.66cfeb7de0a-160000.1.1, 4.22.9+git.538.af6cb4fb2e-160000.1.1, 4.24.5+git.481.dba78dbdea-1.1
ldb-tools
2:2.11.0+samba4.23.6+dfsg-1ubuntu2.2, 2:2.8.0+samba4.19.5+dfsg-4ubuntu9.7, 4.21.10+git.533.31d7e5508d-150700.3.29.1, 4.22.11+git.552.66cfeb7de0a-160000.1.1, 4.22.9+git.538.af6cb4fb2e-160000.1.1, 4.24.5+git.481.dba78dbdea-1.1
libldb-dev
2:2.11.0+samba4.23.6+dfsg-1ubuntu2.2, 2:2.8.0+samba4.19.5+dfsg-4ubuntu9.7
libldb-devel
4.21.10+git.533.31d7e5508d-150700.3.29.1, 4.22.11+git.552.66cfeb7de0a-160000.1.1, 4.22.9+git.538.af6cb4fb2e-160000.1.1, 4.24.5+git.481.dba78dbdea-1.1
libldb2
2:2.11.0+samba4.23.6+dfsg-1ubuntu2.2, 2:2.8.0+samba4.19.5+dfsg-4ubuntu9.7, 4.21.10+git.533.31d7e5508d-150700.3.29.1, 4.22.11+git.552.66cfeb7de0a-160000.1.1, 4.22.9+git.538.af6cb4fb2e-160000.1.1, 4.24.5+git.481.dba78dbdea-1.1
libldb2-32bit
4.21.10+git.533.31d7e5508d-150700.3.29.1, 4.24.5+git.481.dba78dbdea-1.1
libnss-winbind
2:4.15.13+dfsg-0ubuntu1.13, 2:4.19.5+dfsg-4ubuntu9.7, 2:4.23.6+dfsg-1ubuntu2.2
libpam-winbind
2:4.15.13+dfsg-0ubuntu1.13, 2:4.19.5+dfsg-4ubuntu9.7, 2:4.23.6+dfsg-1ubuntu2.2
libsamba-policy-devel
4.15.13+git.729.a8ce057e8d-3.109.1, 4.15.13+git.808.eeca19f5e1-150400.3.52.1, 4.17.12+git.581.f49579c6cd-150500.3.42.1, 4.19.8+git.501.67274891bc-150600.3.29.1
libsamba-policy-python3-devel
4.15.13+git.729.a8ce057e8d-3.109.1, 4.15.13+git.808.eeca19f5e1-150400.3.52.1, 4.17.12+git.581.f49579c6cd-150500.3.42.1, 4.19.8+git.501.67274891bc-150600.3.29.1
libsamba-policy0-python3
4.15.13+git.729.a8ce057e8d-3.109.1, 4.15.13+git.808.eeca19f5e1-150400.3.52.1, 4.17.12+git.581.f49579c6cd-150500.3.42.1, 4.19.8+git.501.67274891bc-150600.3.29.1
libsamba-policy0-python3-32bit
4.15.13+git.729.a8ce057e8d-3.109.1
libsmbclient
2:4.15.13+dfsg-0ubuntu1.13
libsmbclient-dev
2:4.15.13+dfsg-0ubuntu1.13, 2:4.19.5+dfsg-4ubuntu9.7, 2:4.23.6+dfsg-1ubuntu2.2
libsmbclient0
2:4.19.5+dfsg-4ubuntu9.7, 2:4.23.6+dfsg-1ubuntu2.2
libtalloc-dev
2:2.4.3+samba4.23.6+dfsg-1ubuntu2.2
libtalloc2
2:2.4.3+samba4.23.6+dfsg-1ubuntu2.2
libtdb-dev
2:1.4.14+samba4.23.6+dfsg-1ubuntu2.2
libtdb1
2:1.4.14+samba4.23.6+dfsg-1ubuntu2.2
libtevent-dev
2:0.17.1+samba4.23.6+dfsg-1ubuntu2.2
libtevent0t64
2:0.17.1+samba4.23.6+dfsg-1ubuntu2.2
libwbclient-dev
2:4.15.13+dfsg-0ubuntu1.13, 2:4.19.5+dfsg-4ubuntu9.7, 2:4.23.6+dfsg-1ubuntu2.2
libwbclient0
2:4.15.13+dfsg-0ubuntu1.13, 2:4.19.5+dfsg-4ubuntu9.7, 2:4.23.6+dfsg-1ubuntu2.2
python3-ldb
2:2.11.0+samba4.23.6+dfsg-1ubuntu2.2, 2:2.8.0+samba4.19.5+dfsg-4ubuntu9.7, 4.21.10+git.533.31d7e5508d-150700.3.29.1, 4.22.11+git.552.66cfeb7de0a-160000.1.1, 4.22.9+git.538.af6cb4fb2e-160000.1.1, 4.24.5+git.481.dba78dbdea-1.1
Timeline
Publicly disclosed
Jul 28, 2026
Last updated
Jul 31, 2026
Weakness Type
- CWE-284 Improper Access Control
References
- advisorysecurity-tracker.debian.org · CVE-2026-58221
- advisoryubuntu.com · CVE-2026-58221
- advisorycve.org · CVERecord
- advisoryUSN-8621-1
FAQ
Common Questions.
Samba AD authenticated LDAP access domain takeover.
Affected: samba (alpine); ctdb (ubuntu); ldb-tools (ubuntu), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ctdb 2:4.15.13+dfsg-0ubuntu1.13, ctdb 2:4.19.5+dfsg-4ubuntu9.7, ctdb 2:4.23.6+dfsg-1ubuntu2.2.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-58221 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo