CVE-2026-1933: Samba: missing access check on reparse point operations
Vulnerability summary
CVE-2026-1933 is a high (CVSS 7.1) Improper Access Control vulnerability in redhat enterprise_linux. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 58.6% of scored vulnerabilities.
Not severe (CVSS 7.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 17 · Related 9Timeline
- 27-05-2026PublishedVulnerability first disclosed.
- 30-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
0.86%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.86% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat2 products
- enterprise_linuxEOL7.0 | 8.0 | 9.0 | 10.0
- openshift_container_platform4.0
Alpine1 product
- samba≥ 4.1.0, < 4.22.10-r0 | ≥ 4.1.0, < 4.23.8-r0
Debian1 product
- samba< 2:4.22.8+dfsg-0+deb13u2 | < 2:4.24.3+dfsg-1
Samba1 product
- samba≥ 4.1.0, < 4.2.2
Ubuntu1 product
- samba< 2:4.22.3+dfsg-4ubuntu2.4 | < 2:4.23.6+dfsg-1ubuntu2.1
5 vendors · 6 products
