CVE-2026-4408
Critical · 9.0CVSS
9.0
EPSS
1.8%
Published
May 28, 2026
CISA due date
—
The record
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | samba | 0 | 4.22.9+git.506.22c03ce0781-160000.1.1 |
| openSUSE:Tumbleweed | samba | 0 | 4.23.8+git.477.f78166bceed-1.1 |
Related vulnerabilities
- CVE-2026-3238 A flaw was found in Samba’s WINS server component when running as an Active Directory… Also affects samba
- CVE-2026-1933 A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured… Also affects samba
- CVE-2026-2340 A flaw was found in Samba’s vfs_worm module. Also affects samba
- CVE-2026-3012 A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. Also affects samba
- CVE-2026-4480 A flaw was found in the Samba printing subsystem. Also affects samba
- CVE-2025-10230 A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from… Also affects samba
- CVE-2026-40170 ngtcp2 is a C implementation of the IETF QUIC protocol. Also affects samba
- CVE-2017-11103 Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre… Also affects samba