Loading story…
The Samba project released security updates for versions 4.22.10, 4.23.8, and 4.24.3 to fix six vulnerabilities spanning file sharing, Active Directory, DCE/RPC, certificate enrollment, and printing. The most severe issues are two unauthenticated remote code execution flaws: CVE-2026-4408 in the SAMR password validation path, where shell metacharacters in the %u substitution can be abused through crafted RPC requests when the check password script feature is enabled under specific non-default conditions, and CVE-2026-4480 in the printing subsystem under similarly specific configurations. Samba said affected systems include file servers, classic non-AD domain controllers, and print servers, while Active Directory Domain Controllers are not affected by the SAMR RCE issue.
The same release also patched CVE-2026-1933, which lets authenticated users bypass read only = yes restrictions by modifying reparse points when they also have underlying filesystem write access, and CVE-2026-3012, which allowed Group Policy certificate auto-enrollment to fetch CA certificates over plaintext HTTP and install them without validation, enabling adjacent-network trust-store poisoning and TLS interception. Ubuntu issued USN-8306-1 for supported releases, and downstream vendors including Red Hat, Debian, and SUSE also published advisories or updates. Administrators were advised to apply standard package updates promptly, especially where non-default Samba password-checking, printing, or certificate auto-enrollment features are enabled.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-26, Ubuntu published security notice USN-8306-1 covering multiple Samba vulnerabilities across Ubuntu 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS. The notice provided fixed package versions and advised users to apply standard system updates.
On 2026-05-26, the Samba project released security updates including versions 4.22.10 and 4.24.3 to fix six vulnerabilities affecting file sharing, Active Directory, DCE/RPC, and printing-related functionality. The fixes included CVE-2026-1933, CVE-2026-3012, CVE-2026-4408, and another unauthenticated RCE in the printing subsystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
zeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourceubuntu.com
Open sourcesamba.org
Open sourcesamba.org
Open sourcesamba.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Samba released security updates `4.24.3`, `4.23.8`, and `4.22.10` to fix six vulnerabilities affecting SMB, Active Directory, printing, and DCE/RPC components. The most serious issues are **CVE-2026-4408** and **CVE-2026-4480**, command-injection flaws that can lead to remote code execution in specific configurations. **CVE-2026-4408** affects the SAMR DCE/RPC service when `samba-dcerpcd` is used with the `check password script` option and unsafe `%u` expansion, while **CVE-2026-4480** affects the printing subsystem because Samba passed a client-controlled job description through the `%J` substitution in `print command` without properly escaping shell metacharacters.
Jun 29, 2026
Multiple critical Samba flaws have highlighted how non-default but dangerous configurations can turn exposed file-sharing infrastructure into a remote code execution path. `CVE-2025-10230` affects Samba's WINS server on Active Directory Domain Controllers when WINS support is enabled and a non-empty `wins hook` is configured, allowing an unauthenticated attacker to send a crafted WINS registration packet to UDP port `137` and inject shell metacharacters into a command executed by Samba, potentially with root privileges. Separately, `CVE-2026-4480` and `CVE-2026-4408`, both rated `CVSS 10.0`, affect Samba's printing subsystem and DCE/RPC SAMR server when administrators use vulnerable `print command` or `check password script` settings with `%J` or `%u` substitution characters. Samba issued fixes for the WINS flaw in versions `4.23.2`, `4.22.5`, and `4.21.9`, and for the later command-injection issues in `4.22.10`, `4.23.8`, and `4.24.3`. Reporting on internet exposure said more than 63,000 Samba assets were reachable on TCP `445`, underscoring the risk that misconfigured public SMB services could be used for server takeover, credential theft, ransomware deployment, and lateral movement. Defenders were urged to patch affected releases, audit `smb.conf` for risky `wins hook`, `print command`, and password-check script settings, monitor UDP `137` and SMB activity for suspicious behavior, and restrict external access with firewalls, VPNs, or IP allowlists.
Jun 29, 2026
Drupal disclosed **SA-CONTRIB-2026-031**, a critical authentication bypass vulnerability in the **SAML SSO - Service Provider** module affecting versions prior to `3.1.4`. The Canadian Centre for Cyber Security warned that organizations using the product should review Drupal’s guidance and apply the vendor update, as the flaw could allow unauthorized access through affected single sign-on deployments. Separately, Samba maintainers announced upcoming security releases for versions `4.22`, `4.23`, and `4.24` to address six vulnerabilities spanning file services, domain members, and Active Directory Domain Controller components. A follow-up correction said a **CVSS 10.0** file-services issue affects uncommon configurations rather than some configurations, and clarified that one Active Directory-related flaw impacts domain members rather than AD domain controllers; administrators were urged to deploy the Samba updates promptly after release.
Jun 29, 2026