The ADSys auto‑enrollment component retrieves the CA certificate from an AD CS server using an unencrypted HTTP request. An attacker who can observe traffic between the Ubuntu host and the AD CS server can substitute any attacker‑controlled root CA certificate. The system automatically installs this certificate into the local trust store via update‑ca‑certificates, effectively poisoning it. Consequently, all TLS clients on the affected machine will trust rogue certificates for arbitrary domains, allowing persistent interception and decryption of encrypted traffic. This flaw exemplifies improper restriction of operations within a trusted computing base (CWE‑348).

The vulnerability affects Canonical ADSys versions up through 0.16.2 installed on Ubuntu 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS. All systems using the default ADSys package on these releases are susceptible until upgraded to 0.16.3 or later.

The CVSS score of 9 indicates critical severity, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker positioned between the host and the AD CS server can perform a man‑in‑the‑middle attack by intercepting the plaintext HTTP request, supplying a malicious certificate, and thereby compromising all subsequent TLS traffic from the host. The attack requires only network visibility and has no additional authentication or privileged conditions.