CVE-2026-4408: Samba: remote code execution in samr
Vulnerability summary
CVE-2026-4408 is a critical (CVSS 9.8) vulnerability in redhat enterprise_linux. EPSS estimates a 2.50% chance of exploitation in the next 30 days, higher than 84.7% of scored vulnerabilities.
Severe, CVSS 9 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 3% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 20 · Related 10Timeline
- 28-05-2026PublishedVulnerability first disclosed.
- 03-11-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA9.0CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HDiffers
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.50%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
Increase +0.75 pp
From 1.75% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat2 products
- enterprise_linuxEOL6.0 | 7.0 | 9.0
- openshift_container_platform4.0
Alpine1 product
- samba≥ 4.1.0, < 4.22.10-r0 | ≥ 4.1.0, < 4.23.8-r0
Debian1 product
- samba< 2:4.17.12+dfsg-0+deb12u4 | < 2:4.22.8+dfsg-0+deb13u2 | < 2:4.24.3+dfsg-1
Samba1 product
- samba≥ 4.1.0, < 4.21.0
Ubuntu1 product
- sambaAll versions (No fix recorded) | < 2:4.15.13+dfsg-0ubuntu0.20.04.8+esm2 | < 2:4.15.13+dfsg-0ubuntu1.12 | < 2:4.19.5+dfsg-4ubuntu9.6 | < 2:4.22.3+dfsg-4ubuntu2.4 | < 2:4.23.6+dfsg-1ubuntu2.1
5 vendors · 6 products
