This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Samba fixes 6 vulnerabilities

Samba fixes 6 vulnerabilities, 1 of them critical, with versions 4.24.2, 4.23.7 and 4.22.9. The most severe of them are described below, the remaining ones can be found at [1]. Individual Debian and Ubuntu releases and their fixed versions: Debian [2]: bookworm - 2:4.17.12+dfsg-0+deb12u4 trixie - 2:4.22.8+dfsg-0+deb13u2 Ubuntu [3]: resolute - 2:4.23.6+dfsg-1ubuntu2.1 questing - 2:4.22.3+dfsg-4ubuntu2.4 noble - 2:4.19.5+dfsg-4ubuntu9.6 jammy - 2:4.15.13+dfsg-0ubuntu1.12

Samba - RCE (CVE-2026-4408)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can execute arbitrary commands due to insufficient escaping of shell metacharacters in the user name (controlled by the client and passed via the %u substitution to the “check password script”) [4].

The vulnerability is present in product:

  • Samba; >=4.24.0, <4.24.2; >=4.23.0, <4.23.7; >=4.22.0, <4.22.9

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-4408 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 26. 5. 2026.

Samba - RCE (CVE-2026-4480)
CVSS 8.5 (High)

An unauthenticated remote attacker can execute arbitrary commands due to insufficient escaping of shell metacharacters in the print job description (controlled by the client and passed via the %J substitution to the “print command”) [5].

The vulnerability is present in product:

  • Samba; >=4.24.0, <4.24.2; >=4.23.0, <4.23.7; >=4.22.0, <4.22.9

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-4480 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 26. 5. 2026.

Samba - communication spoofing (CVE-2026-3012)
CVSS 8.0 (High)

An unauthenticated attacker on the local network with the ability to intercept or redirect network traffic can forge a malicious certificate authority certificate and eavesdrop on or spoof trusted communication [6].

The vulnerability is present in product:

  • Samba; >=4.24.0, <4.24.2; >=4.23.0, <4.23.7; >=4.22.0, <4.22.9

CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 26. 5. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 28. 5. 2026.

CESNET, z.s.p.o. Logo