Loading story…
Samba 4.25.0 is available with support for SMB3 persistent handles, enabling eligible open files to recover after connection failures and supporting transparent-failover deployments. The release also introduces vfs_aio_ratelimit, which uses the ratelimitd daemon to apply shared asynchronous-I/O limits, and vfs_ceph_rgw for exporting Ceph Object Gateway storage through SMB.
The update adds Active Directory cluster functional-level management to facilitate rolling upgrades and changes the default Kerberos encryption settings. It also fixes CVE-2026-20833, an interoperability issue affecting Windows Kerberos authentication; organizations running Samba Active Directory domain controllers or SMB services should assess upgrade compatibility and deploy the release through their standard change process.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Samba 4.25.0 was released, adding SMB3 persistent-handle support, new VFS modules, and Active Directory cluster functional-level management. The release also fixes CVE-2026-20833, a Windows Kerberos authentication interoperability issue, and changes Kerberos encryption defaults for functional levels 2008 and later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Samba 4.25.0 has been released with experimental **SMB3 Persistent Handles**, enabling eligible clients to reconnect to open files after server restarts, outages, or transparent-failover events without losing their handles. The capability improves service continuity for SMB deployments but incurs a significant performance overhead because Samba records open, update, lease, and close operations twice. The release also introduces `vfs_aio_ratelimit` and the `ratelimitd` daemon for centrally managing asynchronous-I/O limits, plus `vfs_ceph_rgw` to export Ceph Object Gateway buckets through SMB. Samba adds Active Directory cluster functional-level management for rolling upgrades, improves JSON audit logging, changes default domain Kerberos encryption types to AES, and retains legacy AES types needed for interoperability related to Microsoft Windows Kerberos vulnerability **CVE-2026-20833**.
Sep 25, 2026
The Samba project released security updates for versions `4.22.10`, `4.23.8`, and `4.24.3` to fix six vulnerabilities spanning file sharing, Active Directory, DCE/RPC, certificate enrollment, and printing. The most severe issues are two unauthenticated remote code execution flaws: **CVE-2026-4408** in the SAMR password validation path, where shell metacharacters in the `%u` substitution can be abused through crafted RPC requests when the `check password script` feature is enabled under specific non-default conditions, and **CVE-2026-4480** in the printing subsystem under similarly specific configurations. Samba said affected systems include file servers, classic non-AD domain controllers, and print servers, while Active Directory Domain Controllers are not affected by the SAMR RCE issue. The same release also patched **CVE-2026-1933**, which lets authenticated users bypass `read only = yes` restrictions by modifying reparse points when they also have underlying filesystem write access, and **CVE-2026-3012**, which allowed Group Policy certificate auto-enrollment to fetch CA certificates over plaintext HTTP and install them without validation, enabling adjacent-network trust-store poisoning and TLS interception. Ubuntu issued **USN-8306-1** for supported releases, and downstream vendors including Red Hat, Debian, and SUSE also published advisories or updates. Administrators were advised to apply standard package updates promptly, especially where non-default Samba password-checking, printing, or certificate auto-enrollment features are enabled.
Jul 10, 2026Samba released security updates `4.24.3`, `4.23.8`, and `4.22.10` to fix six vulnerabilities affecting SMB, Active Directory, printing, and DCE/RPC components. The most serious issues are **CVE-2026-4408** and **CVE-2026-4480**, command-injection flaws that can lead to remote code execution in specific configurations. **CVE-2026-4408** affects the SAMR DCE/RPC service when `samba-dcerpcd` is used with the `check password script` option and unsafe `%u` expansion, while **CVE-2026-4480** affects the printing subsystem because Samba passed a client-controlled job description through the `%J` substitution in `print command` without properly escaping shell metacharacters.
Jun 29, 2026