CVE-2026-1933
High · 7.1CVSS
7.1
EPSS
0.9%
Published
May 27, 2026
CISA due date
—
The record
A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | samba | 0 | 4.22.9+git.506.22c03ce0781-160000.1.1 |
| openSUSE:Tumbleweed | samba | 0 | 4.23.8+git.477.f78166bceed-1.1 |
Related vulnerabilities
- CVE-2026-3238 A flaw was found in Samba’s WINS server component when running as an Active Directory… Also affects samba
- CVE-2026-4408 A flaw was found in Samba. Also affects samba
- CVE-2026-2340 A flaw was found in Samba’s vfs_worm module. Also affects samba
- CVE-2026-3012 A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. Also affects samba
- CVE-2026-4480 A flaw was found in the Samba printing subsystem. Also affects samba
- CVE-2025-10230 A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from… Also affects samba
- CVE-2026-40170 ngtcp2 is a C implementation of the IETF QUIC protocol. Also affects samba
- CVE-2017-11103 Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre… Also affects samba