Servers and applications
CVE-2016-2113 Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.
Severity High 7.4
Published 25 Apr 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 2.7% in the next 30 daysHigher than 85% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can Read data · Change data
CVSS vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Sources NVD Affected software Software Affected versions SambaServers and applications · cpe:a:samba:samba Version 4.4.0 Version 4.3.6 Version 4.3.5 Version 4.3.4 All 72 release lines Version 4.0.0 Version 4.0.1 Version 4.0.2 Version 4.0.3 Version 4.0.4 Version 4.0.5 Version 4.0.6 Version 4.0.7 Version 4.0.8 Version 4.0.9 Version 4.0.10 Version 4.0.11 Version 4.0.12 Version 4.0.13 Version 4.0.14 Version 4.0.15 Version 4.0.16 Version 4.0.17 Version 4.0.18 Version 4.0.19 Version 4.0.20 Version 4.0.21 Version 4.0.22 Version 4.0.23 Version 4.0.24 Version 4.0.25 Version 4.0.26 Version 4.1.0 Version 4.1.1 Version 4.1.2 Version 4.1.3 Version 4.1.4 Version 4.1.5 Version 4.1.6 Version 4.1.7 Version 4.1.8 Version 4.1.9 Version 4.1.10 Version 4.1.11 Version 4.1.12 Version 4.1.13 Version 4.1.14 Version 4.1.15 Version 4.1.16 Version 4.1.17 Version 4.1.18 Version 4.1.19 Version 4.1.20 Version 4.1.21 Version 4.1.22 Version 4.1.23 Version 4.2.0-rc1 Version 4.2.0-rc2 Version 4.2.0-rc3 Version 4.2.0-rc4 Version 4.2.1 Version 4.2.2 Version 4.2.3 Version 4.2.4 Version 4.2.5 Version 4.2.6 Version 4.2.7 Version 4.2.8 Version 4.2.9 Version 4.3.0 Version 4.3.1 Version 4.3.2 Version 4.3.3 Version 4.3.4 Version 4.3.5 Version 4.3.6 Version 4.4.0
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-2113 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-2113