CVE-2026-4408: Critical Samba Command Injection
Critical CVSS (9.0) reachable over network.
TL;DR - CVE-2026-4408 is a CVSS 9.0 Samba command-injection flaw in a non-standard configuration. - Systems using
check password scriptwith%u, especially privilegedsamba-dcerpcd, may be exposed. - No verified public PoC, confirmed in-the-wild exploitation, or CISA KEV listing is known. Patch or disable the feature urgently.
Summary
CVE-2026-4408 is a critical Samba command injection vulnerability involving improper neutralization of shell metacharacters in the check password script configuration. A remote attacker may submit a crafted username that is inserted into a configured command through the %u substitution character. If Samba passes that value to a shell without appropriate escaping, the attacker may append commands and achieve remote code execution on the host.
The vulnerability is not described as affecting default Samba deployments. Exposure depends on a specific configuration and service arrangement: check password script must be enabled, %u must be included, and a reachable Samba service must process attacker-controlled usernames. The impact is nevertheless severe because successful exploitation may provide remote command execution with the privileges of the affected Samba process or invoked script.
For broader context on vulnerability prioritization, review our CVE-2026-14605 analysis.
| Field | Value |
|---|---|
| CVE | CVE-2026-4408 |
| CVSS base score | 9.0 — Critical |
| CVSS vector | Not exposed in the returned NVD record |
| Attack vector | Network |
| Authentication | Unauthenticated remote exploitation is described |
| Privileges required | Not explicitly published in the available record; assess as potentially none when the vulnerable endpoint is reachable |
| Vulnerability class | CWE-78, OS command injection |
| Patch status | Yes, vendor package fixes are referenced for affected Red Hat products |
| CISA KEV | Not listed |
| Published | 2026-05-28 |
| Last modified | 2026-10-26 |
The returned NVD data did not include the complete CVSS vector. Verify the precise component values for attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability directly in the authoritative CVE record before using them for formal risk calculations.
Analyst’s Take: Start with configuration exposure, not package inventory. A host is most concerning when
check password scriptuses%u, the Samba service is reachable, and the process or invoked script has elevated privileges. The absence of a verified public PoC or KEV listing does not reduce the urgency of disabling or patching that configuration.
Root Cause
The root cause is unsafe handling of the %u substitution value in Samba’s check password script feature. %u represents a username supplied by the client. When the configured command includes that substitution and the value is passed to a shell without reliable escaping, shell metacharacters can alter the intended command structure.
Characters such as command separators, substitutions, redirects, or shell control operators may be interpreted as syntax rather than data. The exact payload and execution behavior depend on the configured command, shell, quoting, service privileges, and operating-system environment. Quoting one layer of a command does not make the arrangement safe if client-controlled text is still evaluated by a shell.
Technical Notes
The relevant configuration should be treated as high risk when it resembles the following pattern:
[global]
check password script = /usr/local/bin/check-password %u
This excerpt illustrates the dangerous data flow; it is not a recommended configuration. The risk is present when %u is substituted into a command that invokes a shell or shell-like interpreter. A safer design is to avoid shell command construction entirely and use an authentication mechanism that accepts the username as a structured argument or through a well-defined API.
The issue becomes more consequential when samba-dcerpcd is started as a system service or the invoked script inherits elevated privileges. A successful injection may then permit changes to files, credential access, lateral movement, persistence, or service disruption, subject to the account and confinement controls applied to the process.
Who’s Exposed
The primary exposure condition is a Samba server or classic domain controller configured with check password script and a %u substitution. The client must be able to reach the relevant Samba functionality and influence the username value. Systems that do not enable the feature, do not use %u, or do not pass the value to a shell may not be exploitable even if their Samba package is within a nominally affected product branch.
Available NVD-related package data identifies the following Red Hat product thresholds as fixed or unaffected. These are distribution package versions, not upstream Samba release numbers, and should be confirmed against the applicable Red Hat erratum:
| Product | Fixed or unaffected package threshold |
|---|---|
| Red Hat Enterprise Linux 10 | 4.23.5-109.el10_2 or later |
| Red Hat Enterprise Linux 10.0 Extended Update Support | 4.21.3-114.el10_0.1 or later |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | 4.10.16-26.el7_9.1 or later |
| Red Hat Enterprise Linux 8 | 4.19.4-16.el8_10 or later |
| Red Hat OpenShift Container Platform 4.19 | 4.19.9.6.202606241344-0 or later |
The available record does not provide one authoritative upstream Samba affected-version range. Do not translate the Red Hat package thresholds into upstream version claims. Inventory should be based on the installed vendor package and the relevant vendor advisory, not only on a source-tree version comparison.
Technical Notes
Search both the primary Samba configuration and included configuration files:
sudo grep -RniE '^[[:space:]]*check[[:space:]]+password[[:space:]]+script' \
/etc/samba /etc/smb.conf 2>/dev/null
Then identify whether %u is present:
sudo grep -RniE 'check[[:space:]]+password[[:space:]]+script.*%u|%u.*check[[:space:]]+password[[:space:]]+script' \
/etc/samba /etc/smb.conf 2>/dev/null
Use Samba’s effective configuration output where available, because a setting may be inherited or supplied through an included file:
sudo testparm -s 2>/dev/null | grep -i -A2 -B2 'check password script'
Severity Breakdown
The assigned CVSS base score is 9.0, rated Critical. The available research note states that the issue is remotely exploitable and may permit unauthenticated command execution. That combination makes the vulnerability operationally significant even though exploitation requires a particular, non-default configuration.
The complete CVSS vector was not returned in the available NVD response. The exact values for attack complexity, privileges required, scope, and impact components therefore cannot be responsibly reconstructed. Do not treat an assumed vector as authoritative. The practical impact assessment is clearer than the missing vector: an attacker who reaches a vulnerable service may be able to execute arbitrary commands with the privileges available to Samba or the configured script.
| Severity consideration | Assessment |
|---|---|
| Network reachability | Remote access to the affected Samba functionality is required |
| Authentication | The description characterizes exploitation as unauthenticated |
| Configuration dependency | High; check password script and %u are central conditions |
| Confidentiality impact | Potentially high if command execution exposes local data |
| Integrity impact | Potentially high if the process can modify files or configuration |
| Availability impact | Potentially high if commands can stop services or alter the host |
| CVSS base score | 9.0, Critical |
| Full vector | Not available in the returned record |
Prioritize risk by exposure rather than package presence alone. Internet-reachable Samba services, classic domain controllers serving untrusted networks, and systems running Samba components with elevated privileges deserve immediate investigation. Internal-only systems still require action where users or compromised hosts can submit untrusted usernames.
Exploitation Status
CVE-2026-4408 is not listed in the CISA Known Exploited Vulnerabilities catalog. The available lookup returned on_kev: false, with no CISA dateAdded, dueDate, required action, or ransomware-campaign designation. No evidence in the supplied sources confirms active exploitation in the wild.
A SentinelOne vulnerability entry reported that no verified public proof-of-concept code was available. The GitHub Advisory Database entry identifies the issue as critical and maps it to CWE-78, but does not provide known affected or patched upstream versions and states that no source code is known. The current status should therefore be stated precisely: no verified public PoC and no confirmed in-the-wild exploitation were identified in the reviewed sources.
That status is not a reason to defer remediation. Command injection through a client-controlled username is a relatively understandable attack pattern, and a capable attacker could develop a targeted exploit after identifying exposed configurations. Organizations should avoid exposing SMB or related Samba services directly to the internet regardless of whether a public exploit is available.
Sources
The primary vulnerability record is the National Vulnerability Database entry for CVE-2026-4408:
The available research identified the following Red Hat advisories as references for fixed package builds:
Additional references include:
The available sources do not provide a verified public exploit, confirmed in-the-wild exploitation, a complete CVSS vector, or one authoritative upstream Samba affected-version range. Treat those fields as unknown rather than infer them. The actionable facts are the configuration dependency, the critical 9.0 base score, the available vendor package fixes, and the potential for remote command execution when %u reaches a shell command.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should combine configuration review, authentication telemetry, process monitoring, and network exposure assessment. A username containing shell metacharacters is not proof of exploitation, because legitimate environments may contain unusual names or malformed requests. Suspicious usernames followed by child-process creation from Samba are high-value events for investigation.
On Linux hosts, identify processes launched by Samba services and review their parent-child relationships:
sudo ausearch -m EXECVE -ts recent 2>/dev/null | \
grep -Ei 'smbd|samba-dcerpcd|check-password|/bin/sh|/bin/bash'
If auditd is deployed, a more durable rule can monitor execution by the relevant service binaries. The exact executable path differs by distribution, so validate paths before production deployment:
sudo auditctl -a always,exit -F arch=b64 \
-S execve -F path=/usr/sbin/samba-dcerpcd \
-k samba-dcerpcd-exec
Technical Notes
Useful indicators include a Samba process spawning an unexpected interpreter or utility, such as sh, bash, curl, wget, nc, python, perl, or socat. A generic SIEM query can be adapted as follows:
process.parent.name IN ("smbd", "samba-dcerpcd", "samba")
AND process.name IN ("sh", "bash", "dash", "zsh", "curl", "wget", "nc", "ncat",
"python", "python3", "perl", "socat")
Review Samba, systemd journal, and audit records for requests or authentication events containing shell-significant characters in usernames. Depending on log encoding and application normalization, the same activity may appear as literal characters or escaped values:
username CONTAINS ANY (";", "|", "&", "$(", "`", ">", "<", "\n", "\r")
AND service IN ("smbd", "samba-dcerpcd", "winbindd")
This is a triage signal rather than a complete network signature. Do not rely only on packet inspection: SMB protocol encoding, logging configuration, and downstream normalization may obscure the original username. Correlate suspicious username events with process creation, outbound connections, file changes, and privilege transitions within a short time window.
Remediation Steps
The preferred remediation is to install the vendor package applicable to the host. The available product thresholds indicate that Red Hat systems should be at or above the following package versions: RHEL 10 4.23.5-109.el10_2, RHEL 10.0 EUS 4.21.3-114.el10_0.1, RHEL 7 ELS 4.10.16-26.el7_9.1, RHEL 8 4.19.4-16.el8_10, and OpenShift Container Platform 4.19 4.19.9.6.202606241344-0.
The referenced Red Hat advisories are RHSA-2026:22644, RHSA-2026:22963, RHSA-2026:25049, RHSA-2026:25979, and RHSA-2026:28053. Because the supplied advisory pages did not expose a complete product-to-advisory mapping, administrators must select the erratum matching their exact product, architecture, repository, and support channel.
Technical Notes
On Red Hat Enterprise Linux, update the Samba packages through the configured repositories:
sudo dnf update 'samba*'
On older systems using Yum:
sudo yum update 'samba*'
Verify the installed package after updating:
rpm -q samba samba-common samba-client 2>/dev/null
rpm -qa | grep '^samba'
Compare the installed package version with the applicable Red Hat advisory rather than assuming that an upstream Samba release number is equivalent to an RPM version. For OpenShift, follow the vendor’s platform update process and validate the Samba package in the affected image or node context; do not manually replace platform-managed components without an approved operational procedure.
If patching cannot be completed immediately, disable the feature when it is not required:
sudo testparm -s
sudo cp -a /etc/samba/smb.conf /etc/samba/smb.conf.pre-cve-2026-4408
sudoedit /etc/samba/smb.conf
Remove or comment the check password script setting, or remove %u from the command after confirming that the authentication workflow will continue to function. Validate the configuration and restart only the required services:
sudo testparm -s
sudo systemctl restart smb smbd nmb 2>/dev/null || true
sudo systemctl restart samba-dcerpcd 2>/dev/null || true
Service names vary by distribution and deployment. Test the change in a maintenance window and confirm authentication, share access, and domain-controller functions afterward. If the feature must remain enabled, replace shell-based command execution with an implementation that treats the username as data, applies strict input validation, and avoids constructing commands through a shell.
Additional compensating controls include restricting SMB access to trusted network segments, removing unnecessary internet exposure, running Samba with the minimum available privileges, applying host confinement, and monitoring for unexpected child processes. These controls reduce impact or exposure but do not replace the vendor fix.
Organizations reviewing this issue alongside ransomware preparedness may also benefit from our ransomware response checklist.