Red Hat Security Advisory: samba security update

Fixed packages 150

Vulnerabilities 5

• Critical 9.0
  CVE-2026-4408 Public exploit EPSS 47%

  Samba: remote code execution in samr

  A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controll…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  May 28, 2026
• Critical 9.0
  CVE-2026-4480 Public exploit Scanner template EPSS 29%

  Samba: samba: remote code execution in printing subsystem via unescaped job description

  A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacke…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  May 26, 2026
• High 8.0
  CVE-2026-3012

  Samba: group policy certificate enrollment uses http:// without validation

  A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verifi…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  May 27, 2026
• High 7.1
  CVE-2026-1933

  Samba: missing access check on reparse point operations

  A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata t…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Alpine
  May 27, 2026
• Medium 6.5
  CVE-2026-2340

  Samba: vfs_worm does not block directory modification

  A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenti…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  May 27, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447317
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447318
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447319
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452232
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479762
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25979.json
• report
  https://access.redhat.com/security/cve/CVE-2026-1933
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1933
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-1933
• article
  https://bugzilla.samba.org/show_bug.cgi?id=15992
• report
  https://access.redhat.com/security/cve/CVE-2026-2340
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-2340
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-2340
• article
  https://bugzilla.samba.org/show_bug.cgi?id=15997
• report
  https://access.redhat.com/security/cve/CVE-2026-3012
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-3012
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-3012
• article
  https://bugzilla.samba.org/show_bug.cgi?id=16003
• report
  https://access.redhat.com/security/cve/CVE-2026-4408
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4408
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4408
• article
  https://bugzilla.samba.org/show_bug.cgi?id=16034
• report
  https://access.redhat.com/security/cve/CVE-2026-4480
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4480
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4480
• article
  https://bugzilla.samba.org/show_bug.cgi?id=16033