Red Hat Security Advisory: samba security update

Fixed packages 65

Vulnerabilities 6

• Critical 9.0
  CVE-2026-4408 Public exploit EPSS 47%

  Samba: remote code execution in samr

  A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controll…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  May 28, 2026
• Critical 9.0
  CVE-2026-4480 Public exploit Scanner template EPSS 29%

  Samba: samba: remote code execution in printing subsystem via unescaped job description

  A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacke…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  May 26, 2026
• High 8.0
  CVE-2026-3012

  Samba: group policy certificate enrollment uses http:// without validation

  A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verifi…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  May 27, 2026
• High 7.5
  CVE-2026-40170

  ngtcp2 has a qlog transport parameter serialization stack buffer overflow

  ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote…

  ngtcp2 ngtcp2 ngtcp2 ngtcp2 Debian Ubuntu Alpine
  Apr 16, 2026
• High 7.1
  CVE-2026-1933

  Samba: missing access check on reparse point operations

  A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata t…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Alpine
  May 27, 2026
• Medium 6.5
  CVE-2026-2340

  Samba: vfs_worm does not block directory modification

  A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenti…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  May 27, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447317
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447318
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447319
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452232
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2459061
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479762
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22963.json
• report
  https://access.redhat.com/security/cve/CVE-2026-1933
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1933
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-1933
• article
  https://bugzilla.samba.org/show_bug.cgi?id=15992
• report
  https://access.redhat.com/security/cve/CVE-2026-2340
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-2340
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-2340
• article
  https://bugzilla.samba.org/show_bug.cgi?id=15997
• report
  https://access.redhat.com/security/cve/CVE-2026-3012
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-3012
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-3012
• article
  https://bugzilla.samba.org/show_bug.cgi?id=16003
• report
  https://access.redhat.com/security/cve/CVE-2026-4408
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4408
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4408
• article
  https://bugzilla.samba.org/show_bug.cgi?id=16034
• report
  https://access.redhat.com/security/cve/CVE-2026-4480
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4480
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4480
• article
  https://bugzilla.samba.org/show_bug.cgi?id=16033
• report
  https://access.redhat.com/security/cve/CVE-2026-40170
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-40170
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-40170
• article
  https://github.com/ngtcp2/ngtcp2/commit/708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5
• article
  https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f