Description
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J"
substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:4.24.3+dfsg-1 | — |
| Debian 13 | samba | 2:4.22.8+dfsg-0+deb13u2 | — |
| Debian 12 | samba | 2:4.17.12+dfsg-0+deb12u4 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | samba | 2:4.23.6+dfsg-1ubuntu2.1 | — |
| Ubuntu 25.10 | samba | 2:4.22.3+dfsg-4ubuntu2.4 | — |
| Ubuntu 24.04 LTS | samba | 2:4.19.5+dfsg-4ubuntu9.6 | — |
| Ubuntu 22.04 LTS | samba | 2:4.15.13+dfsg-0ubuntu1.12 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | samba | 2:4.15.13+dfsg-0ubuntu0.20.04.8+esm2 | USN-8306-2 |
| Ubuntu Pro 18.04 LTS | samba | No fix yet | — |
| Ubuntu Pro 16.04 LTS | samba | No fix yet | — |
| Ubuntu Pro 14.04 LTS | samba | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | samba +36 | 4.23.5-109.el10_2 | RHSA-2026:22963 |
| RHEL 9 | ctdb +37 | 4.23.5-10.el9_8 | RHSA-2026:25049 |
| RHEL 8 | ctdb +33 | 4.19.4-16.el8_10 | RHSA-2026:22644 |
| RHEL 7 | ctdb +1 | 4.10.16-26.el7_9.1 | RHSA-2026:28132 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | samba +36 | 4.21.3-114.el10_0.1 | RHSA-2026:28055 |
| RHEL 9.6 EUS | ctdb +37 | 4.21.3-14.el9_6.1 | RHSA-2026:25979 |
| RHEL 9.4 E4S | ctdb +24 | 4.19.4-105.el9_4.4 | RHSA-2026:28053 |
| RHEL 9.2 E4S | ctdb +24 | 4.17.5-105.el9_2.5 | RHSA-2026:28054 |
| RHEL 8.8 TUS | ctdb +28 | 4.17.5-7.el8_8.1 | RHSA-2026:28056 |
| RHEL 8.8 E4S | ctdb +28 | 4.17.5-7.el8_8.1 | RHSA-2026:28056 |
| RHEL 8.6 EUS Long Life | ctdb +21 | 4.15.5-16.el8_6.1 | RHSA-2026:28057 |
| RHEL 8.6 AUS | ctdb +21 | 4.15.5-16.el8_6.1 | RHSA-2026:28057 |
| RHEL 8.4 EUS Long Life | ctdb +21 | 4.13.3-12.el8_4.1 | RHSA-2026:28058 |
| RHEL 8.4 AUS | ctdb +21 | 4.13.3-12.el8_4.1 | RHSA-2026:28058 |
| RHEL 7 ELS | samba +24 | 4.10.16-26.el7_9.1 | RHSA-2026:28132 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | samba +36 | 4.23.5-109.el10_2 | ALSA-2026:22963 |
| AlmaLinux 9 | samba +36 | 4.23.5-10.el9_8 | ALSA-2026:25049 |
| AlmaLinux 8 | ctdb +33 | 4.19.4-16.el8_10 | ALSA-2026:22644 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | samba | 4.23.5-109.el10_2 | RLSA-2026:22963 |
| Rocky Linux 9 | samba | 4.23.5-10.el9_8 | RLSA-2026:25049 |
| Rocky Linux 8 | samba | 4.19.4-16.el8_10 | RLSA-2026:22644 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | samba | 4.22.9+git.506.22c03ce0781-160000.1.1 | SUSE-SU-2026:23152-1, SUSE-SU-2026:23129-1, SUSE-SU-2026:22080-1 |
| SLES 16.0 | samba | 4.22.9+git.506.22c03ce0781-160000.1.1 | SUSE-SU-2026:23152-1, SUSE-SU-2026:23129-1, SUSE-SU-2026:22080-1 |
| SLE Micro 6.2 | samba | 4.22.9+git.506.22c03ce0781-160000.1.1 | SUSE-SU-2026:23003-1, SUSE-SU-2026:22045-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | samba | 4.23.8+git.477.f78166bceed-1.1 | openSUSE-SU-2026:10884-1 |
| openSUSE Leap 16.0 | samba | 4.22.9+git.506.22c03ce0781-160000.1.1 | openSUSE-SU-2026:21540-1, openSUSE-SU-2026:20905-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | samba | 4.23.8-r0 | — |
| Alpine v3.23 | samba | 4.22.10-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | samba +31 | 2:4.17.12-1.amzn2023.0.4 | ALAS2023-2026-1895 |
| Amazon Linux 2 | ctdb +26 | 4.10.16-24.amzn2.0.7 | ALAS2-2026-3493 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | samba | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | samba +36 | 4.23.5-109.el10_2 | ELSA-2026-22963 |
| Oracle Linux 9 | samba +36 | 4.23.5-10.el9_8 | ELSA-2026-25049 |
| Oracle Linux 8 | ctdb +34 | 4.19.4-16.0.1.el8_10 | ELSA-2026-22644 |
| Oracle Linux 7 | ctdb +26 | 4.10.16-25.0.11.el7_9 | ELSA-2026-28132 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 8 repositories
-
TheCyberGeek/CVE-2026-4480-PoC ★ 23 · Jun 5, 2026
-
ashrafzaryouh/CVE-2026-4480 ★ 3 · Jun 7, 2026
CVE-2026-4480
-
AlanNewberry/CVE-2026-4480-samba-print-command-injection-rce ★ 2 · Oct 3, 2026
Exploit para CVE-2026-4480: inyeccion de comandos en la variable %J del print command de Samba para RCE sin autenticacion via spoolss.
-
saitoken241/CVE-2026-4480-POC ★ 2 · Jun 8, 2026
smb spooler to RCE
-
robinxiang/CVE-2026-4480 ★ 1 · Jun 7, 2026
Exploit CVE-2026-4480
-
timgad794/Abducted-HTB-Writeup ★ 0 · Oct 2, 2026
🔴 HackTheBox Abducted (Medium) — CVE-2026-4480 (Samba %J) → rclone reveal → SMB-Symlink → systemd Drop-in → Root
-
ClearLotus-git/CVE-2026-4480-PoC ★ 0 · Jun 20, 2026
-
Vusal777/CVE-2026-4480-exploit-poc ★ 0 · Jun 16, 2026
This is an exploit poc for CVE-2026-4480
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Samba Printing Subsystem - Remote Code Execution javascript/cves/2026/CVE-2026-4480.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 33
- ALSA-2026:25049 Critical: samba security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:22963 Critical: samba security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:22644 Important: samba security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:28056 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28057 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28055 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28053 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28054 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:25979 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:25049 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:22963 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:22644 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2026-1686 Samba: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2026
- RHSA-2026:28132 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:28058 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- SUSE-SU-2026:23152-1 Security update for samba SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:23129-1 Security update for samba SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:23003-1 Security update for samba SUSE / openSUSE Security Updates · Aug 12, 2026
- openSUSE-SU-2026:21540-1 Security update for samba SUSE / openSUSE Security Updates · Aug 8, 2026
- ELSA-2026-28132 Important: samba security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2026
- ELSA-2026-22963 Critical: samba security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- ALAS2-2026-3493 Important: samba security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- ELSA-2026-25049 Critical: samba security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- ALAS2023-2026-1895 Important: samba security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- SUSE-SU-2026:22080-1 Security update for samba SUSE / openSUSE Security Updates · Jun 16, 2026
- RLSA-2026:25049 Critical: samba security update Rocky Linux Security Advisories · Jun 13, 2026
- RLSA-2026:22963 Critical: samba security update Rocky Linux Security Advisories · Jun 11, 2026
- USN-8306-2 samba vulnerabilities Ubuntu Security Notices (USN) · Jun 10, 2026
- SUSE-SU-2026:22045-1 Security update for samba SUSE / openSUSE Security Updates · Jun 10, 2026
- openSUSE-SU-2026:20905-1 Security update for samba SUSE / openSUSE Security Updates · Jun 9, 2026
- RLSA-2026:22644 Important: samba security update Rocky Linux Security Advisories · Jun 9, 2026
- ELSA-2026-22644 Important: samba security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 3, 2026
- openSUSE-SU-2026:10884-1 ctdb-4.23.8+git.477.f78166bceed-1.1 on GA media SUSE / openSUSE Security Updates · May 29, 2026
References
- RHSA-2026:22644 vendor-advisory
- RHSA-2026:22963 vendor-advisory
- RHSA-2026:25049 vendor-advisory
- RHSA-2026:25979 vendor-advisory
- RHSA-2026:28053 vendor-advisory
- RHSA-2026:28054 vendor-advisory
- RHSA-2026:28055 vendor-advisory
- RHSA-2026:28056 vendor-advisory
- RHSA-2026:28057 vendor-advisory
- RHSA-2026:28058 vendor-advisory
- RHSA-2026:28132 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-4480 vdb-entry
- RHBZ#2452232 issue-tracking
- https://bugzilla.samba.org/show_bug.cgi?id=16033