CVE-2026-4480Critical· 9.0▾ AbyssalPoC availableA flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta charac…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 49.5 · likelihood 2.8 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
14%
8 GitHub repos · Nuclei ×1 (last check)
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.
samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)sambasamba4openshift/ose-rhel-coreos-8 (all versions)openshift/ose-rhel-coreos-9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Remove "%J" from the "print command" in smb.conf entry.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-10230Critical· 10.0A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping
CVE-2026-121621High· 8.8Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration
CVE-2022-2127Medium· 5.9Samba: out-of-bounds read in winbind auth_crap
CVE-2026-109411High· 8.1Samba: access control bypass via vfs_ceph_rgw case-insensitive open
CVE-2020-25720High· 7.5Samba: check attribute access rights for ldap adds of computers
CVE-2026-58224Medium· 6.5A flaw was found in Samba's CTDB, the clustered database service used by Samba