Samba Security Flaw Lets Attackers Execute Code Remotely

A critical security vulnerability in Samba’s printing subsystem has been disclosed, allowing unauthenticated attackers to execute arbitrary code remotely on affected servers. Tracked as CVE-2026-4480, the flaw carries a maximum CVSS score of 10.0, highlighting its severe impact on confidentiality, integrity, and availability.

The issue affects Samba print servers configured with the “print command” and the %J substitution parameter. Samba, widely deployed across enterprise and Linux environments for file and print sharing, improperly handles user-supplied input in this parameter.

Specifically, the client-controlled job description string is passed directly to shell commands without proper sanitization, enabling command injection.

Samba Security RCE Flaw

The vulnerability arises because Samba fails to escape shell meta characters when processing the %J substitution. As a result, attackers can craft malicious print job descriptions containing shell commands that are executed on the server.

Since many Samba print servers allow guest printing by default, exploitation can occur without authentication, significantly increasing the risk.

Not all configurations are vulnerable. Systems using “printing = cups” or “printing = iprint” are not affected, nor are servers that do not include %J in their print command configuration. However, environments that rely on legacy or custom print command settings are particularly exposed.

Although wrapping %J in single quotes (e.g., ‘%J’) can reduce the likelihood of exploitation, it does not fully eliminate the risk. Attackers may still inject malicious command-line arguments, making this mitigation insufficient as a long-term solution.

The Samba team has released security updates to address this flaw in versions 4.22.10, 4.23.8, and 4.24.3. Administrators are strongly advised to upgrade immediately or apply the official patches available through Samba’s security advisory page.

For systems where immediate patching is not feasible, temporary workarounds are recommended. These include removing the %J substitution entirely from the “print command” setting in the smb.conf file or enclosing it in single quotes to reduce risk exposure. However, these measures should be considered interim protections rather than complete fixes.

The vulnerability was discovered and reported by security researchers from SafeBreach, ZeroPath, and Securin Labs. The Samba development team, including contributors from Sernet and Catalyst, has released patches and coordinated the advisory.

Given Samba’s widespread use in enterprise networks and its default configurations that may permit guest access, this vulnerability presents a high-risk attack vector. Organizations should prioritize patching and review their print service configurations to prevent potential exploitation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.