CVE-2026-4408: Samba: remote code execution in samr

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• redhat enterprise linux6.0
• redhat enterprise linux7.0
• redhat enterprise linux9.0
• redhat openshift container platform4.0
• samba samba4.1.0 and later · before 4.21.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Red Hat Enterprise Linux 10

  • 0:4.23.5-109.el10_2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

  • 0:4.21.3-114.el10_0.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 6

  • all versionsunknown
  • all versionsunknown

• Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • 0:4.10.16-26.el7_9.1 and laternot affected · rpm
  • 0:4.10.16-26.el7_9.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8

  • 0:4.19.4-16.el8_10 and laternot affected · rpm
  • 0:4.19.4-16.el8_10 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • 0:4.13.3-12.el8_4.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • 0:4.13.3-12.el8_4.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • 0:4.15.5-16.el8_6.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • 0:4.15.5-16.el8_6.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • 0:4.17.5-7.el8_8.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • 0:4.17.5-7.el8_8.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 9

  • 0:4.23.5-10.el9_8 and laternot affected · rpm
  • 0:4.23.5-10.el9_8 and laternot affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-7494Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious cliKEV
  99Now
• CVE-2015-0240The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x befor
  66This week
• CVE-2003-0085Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, al
  66This week

Published before and after this one in the same product

• ← EarlierCVE-2026-1933May 27, 2026 · Samba: missing access check on reparse point operations
  26Monitor
• ← EarlierCVE-2026-2340May 27, 2026 · Samba: vfs_worm does not block directory modification
  26Monitor
• Later →CVE-2026-58224Aug 14, 2026 · Samba: ctdb fails to do integrity checking of received packets
  26Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.