CVE-2026-4408Disclosure(redhat / enterprise_linux)

CRITICALCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch redhat enterprise_linux systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.

redhat CVEs Back to dashboard

8.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-78

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

enterprise_linux
openshift_container_platform
samba

Threat summary

Active exploitation appears in 2 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
12 mentions across 6 observed days

What's happening

Active exploitation reported across 2 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 4 signals
Technical details provided in 8 signals
Disclosure: 5 classified signals
General: 3 classified signals
Peaked 4d ago at 4 mentions (2026-05-28); latest day: 2
12 total mentions across 6 days

Affected systems

Vendors

redhat samba

Products

enterprise_linuxopenshift_container_platformsamba

4 versions affected across 3 products

Deep dive

Activity timeline12 mentions / 6d

Signal classification4 categories

Disclosure

541.7%

General

325.0%

Patch

216.7%

Active Exploitation

216.7%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-27	1	Patch1
2026-05-28	4	Active Exploitation1Disclosure2General1
2026-05-29	2	Active Exploitation1Patch1
2026-06-02	2	Disclosure2
2026-06-03	1	General1
2026-06-08	2	Disclosure1General1

Full discourse12 posts

Criminal IP@CriminalIP_US125d
Disclosure
🗂️ Samba CVSS 10.0: exposed SMB services are not just open ports CVE-2026-4480 and CVE-2026-4408 show how specific Samba configurations can turn file-sharing infrastructure into a remote code execution risk. Criminal IP findings: • 63,055 internet-exposed Samba assets on port 445 • Exposed services reveal SMB, NetBIOS, domain, and share information • Vulnerable smb.conf settings can increase real-world exploitability When Samba is reachable from the internet, configuration risk becomes attack surface risk. 🔎 Full analysis https://criminalip.io/knowledge-hub/blog/35176 #CyberSecurity #ThreatIntelligence #AttackSurface #Samba #SMB
Post summary
Samba CVEs CVE-2026-4480 and CVE-2026-4408 are identified as high‑severity RCE vulnerabilities linked to misconfigured SMB services, with thousands of exposed assets noted, but no evidence of active exploitation or available patches is provided.
05053557
4.9K followersView on X
CCB Alert@CCBalert137d
Patch
Warning: #Samba has released a security bulletin covering six #CVEs including #CVE-2026-4480 (CVSS:10.0) and #CVE-2026-4408 (CVSS:10.0). Both lead to Remote Code Execution #RCE. Find out more at https://www.samba.org/samba/history/security.html #Patch #Patch #Patch
Post summary
Samba issued a security bulletin for six CVEs, including two with CVSS 10.0 RCE scores, and directs users to a patch page.
02010264
7.2K followersView on X
サイレンススバル🍥@subaru_xv1900cu136d
Patch
Sambaに認証なしRCE CVE-2026-4408、check password scriptの%uでコマンド注入、4.24.3へ即更新を https://kkm-mako.com/blog/articles/samba-cve-2026-4408-check-password-script-rce/
Post summary
The post highlights an authentication‑less RCE in Samba’s check_password script (CVE‑2026‑4408) and urges users to update to 4.24.3 immediately.
0001093
305 followersView on X
Upwind Security MDR@UpwindMDR137d
Disclosure
🚨 Critical - Samba Remote Code Execution via check password script (CVE-2026-4408) A misconfiguration in Samba’s check password script feature may allow remote attackers to achieve RCE through shell metacharacter injection in client-controlled usernames when %u is used without proper escaping. 👉 Affected: Samba 4.1+ using check password script with %u and samba-dcerpcd running as a system service
Post summary
The text announces a new Samba vulnerability (CVE‑2026‑4408) that allows remote RCE through shell injection in usernames when the check password script is misconfigured. No PoC, tool, or active exploitation, patch, or debunking is mentioned.
0001076
196 followersView on X
Orizon@OrizonCyber137d
Disclosure
🚨 CVE-2026-4408 — CVSS 9/10 █████████░ A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/x9FSEWChoK
Post summary
CVE‑2026‑4408 is a critical Samba misconfiguration vulnerability (CVSS 9/10) that has just been disclosed, and the tweet urges users to apply the patch immediately.
1000095
43 followersView on X
DailyCVE@dailycve125d
General
🔴 Samba (Samba), #OS Command Injection, #CVE-2026-4408 (Critical) -DC-Jun2026-276 https://dailycve.com/samba-samba-os-command-injection-cve-2026-4408-critical-dc-jun2026-276/
Post summary
The post references CVE‑2026‑4408 in Samba with an OS command injection issue, but provides no details on PoC, exploitation, or mitigation.
0000046
210 followersView on X
CERT-PY@CERTpy130d
General
⚠️ Vulnerabilidades en productos Samba ❗ CVE-2026-4480 ❗ CVE-2026-4408 ❗ CVE-2026-3012 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-samba-2/ https://t.co/tDy1a4OFXL
Post summary
The text lists three Samba CVEs and provides links for further information, but offers no technical details, exploit code, patch advice, or claims of active exploitation.
00000107
6.7K followersView on X
ねこさん⚡(ΦωΦ)@catnap707132d
Disclosure
Sambaに2件の致命的な脆弱性-CVE-2026-4408とCVE-2026-4480|セキュリティ対策Lab https://rocket-boys.co.jp/security-measures-lab/samba-critical-vulnerabilities-cve-2026-4408-4480/ "CVSS 10.0と評価された2件の認証不要リモートコード実行な脆弱性です。CVE-2026-4480はSambaの印刷サブシステム、CVE-2026-4408はSamba DCE/RPC SAMRサーバに関係します"
Post summary
The text announces two critical Samba vulnerabilities (CVE-2026-4408 and CVE-2026-4480) with a CVSS score of 10.0, highlighting authentication-agnostic remote code execution in specific Samba subsystems.
00000206
3.5K followersView on X
セキュリティ対策Lab@securityLab_jp132d
Disclosure
Sambaに2件の致命的な脆弱性-CVE-2026-4408とCVE-2026-4480 https://rocket-boys.co.jp/security-measures-lab/samba-critical-vulnerabilities-cve-2026-4408-4480/ #セキュリティ対策Lab #security #securitynews
Post summary
The post merely announces two critical Samba vulnerabilities (CVE‑2026‑4408 and CVE‑2026‑4480) without providing technical, exploit, or patch details.
00000155
412 followersView on X
VulDB 🛡@vuldb136d
Active Exploitation
Attention, elevated activities detected targeting Samba (CVE-2026-4408) https://vuldb.com/vuln/366748/cti
Post summary
The alert signals heightened activity against Samba for CVE‑2026‑4408, indicating that this vulnerability is currently being exploited in the wild.
0000084
2.2K followersView on X
𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc136d
Active Exploitation
Recent critical CVEs (e.g., CVE-2026-4408, CVE-2026-32999) with active exploits threaten network security, risking data privacy and integrity in transit. Immediate patching is vital. #Cybersecurity #ZeroDay #News
Post summary
The post alerts that CVE-2026-4408 and CVE-2026-32999 are being actively exploited and urges the immediate application of patches to protect network security.
0000071
14 followersView on X
Open Source Security mailing list@oss_security137d
General
Samba CVE-2026-3238: DoS against AD DC WINS server CVE-2026-4408: Unauthenticated Remote Code Execution in Samba DCE/RPC SAMR server CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing subsystem
Post summary
The passage lists three Samba CVEs, detailing that they involve DoS and unauthenticated RCE, but provides no information on PoCs, exploits, active attacks, or patches.
00000171
4.6K followersView on X

CPE platform detail5 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

5 of 5 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	redhat	enterprise_linux	6.0	-	-
OS	redhat	enterprise_linux	7.0	-	-
OS	redhat	enterprise_linux	9.0	-	-
App	redhat	openshift_container_platform	4.0	-	-
App	samba	samba	-	-	-

Explore more

Back to dashboard redhat CVEs samba CVEs enterprise_linux vulnerabilities

What researchers are saying

CVE-2026-4408

Criminal IP[verified]@CriminalIP_USDisclosure

Samba CVEs CVE-2026-4480 and CVE-2026-4408 are identified as high‑severity RCE vulnerabilities linked to misconfigured SMB services, with thousands of exposed assets noted, but no evidence of active exploitation or available patches is provided.

Upwind Security MDR[verified]@UpwindMDRDisclosure

The text announces a new Samba vulnerability (CVE‑2026‑4408) that allows remote RCE through shell injection in usernames when the check password script is misconfigured. No PoC, tool, or active exploitation, patch, or debunking is mentioned.

Orizon[verified]@OrizonCyberDisclosure

CVE‑2026‑4408 is a critical Samba misconfiguration vulnerability (CVSS 9/10) that has just been disclosed, and the tweet urges users to apply the patch immediately.

セキュリティ対策Lab[verified]@securityLab_jpDisclosure

The post merely announces two critical Samba vulnerabilities (CVE‑2026‑4408 and CVE‑2026‑4480) without providing technical, exploit, or patch details.

CCB Alert@CCBalertPatch

Samba issued a security bulletin for six CVEs, including two with CVSS 10.0 RCE scores, and directs users to a patch page.

サイレンススバル🍥@subaru_xv1900cuPatch

The post highlights an authentication‑less RCE in Samba’s check_password script (CVE‑2026‑4408) and urges users to update to 4.24.3 immediately.

DailyCVE@dailycveGeneral

The post references CVE‑2026‑4408 in Samba with an OS command injection issue, but provides no details on PoC, exploitation, or mitigation.

CERT-PY@CERTpyGeneral

The text lists three Samba CVEs and provides links for further information, but offers no technical details, exploit code, patch advice, or claims of active exploitation.