Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
5 versions affected across 3 products
| Date | Total | Labels |
|---|
| 2026-05-27 | 1 | Patch1 |
| 2026-05-28 | 1 | Disclosure1 |
| 2026-05-29 | 2 | Active Exploitation1Disclosure1 |
| 2026-05-31 | 1 | Patch1 |
| 2026-06-01 | 2 | General1Patch1 |
| 2026-06-02 | 1 | Patch1 |
| 2026-06-03 | 1 | General1 |
| 2026-06-05 | 2 | Disclosure1General1 |
| 2026-06-06 | 1 | Exploit1 |
| 2026-06-08 | 4 | Disclosure2General2 |
| 2026-06-09 | 1 | General1 |
| 2026-06-10 | 1 | Disclosure1 |
| 2026-06-11 | 1 | Disclosure1 |
| 2026-06-25 | 1 | General1 |
| 2026-06-30 | 1 | Disclosure1 |
| 2026-07-12 | 1 | PoC1 |
| 2026-07-22 | 1 | Exploit1 |
| 2026-08-04 | 1 | PoC1 |
CVE-2026-4480 - Samba print-command (%J) injection -> unauthenticated RCE. PoC https://github.com/TheCyberGeek/CVE-2026-4480-PoC/blob/main/exploit.py https://t.co/79HZLJN23x
Post summary
The post reveals an unauthenticated RCE in Samba via a %J injection and shares a PoC exploit script hosted on GitHub.
A Samba print job name should not be able to become a shell command. But with CVE-2026-4480, an unauthenticated attacker who can reach a guest printer share can achieve pre-auth command execution through Samba’s printing path. In our latest War Room blog, we break down what makes this vulnerability dangerous, how attackers can weaponize it through spoolss, what defenders should hunt for, and how to mitigate exposure. We also built it into Abducted, a new Medium Linux CVE Machine on HTB Labs, so you can explore the vulnerability hands-on. Read the full analysis: https://okt.to/NDOzkx #HackTheBox #CVE #CVE20264480 #Samba #LinuxSecurity #RCE #CyberSecurity #ThreatHunting #VulnerabilityResearch
Post summary
The post discusses CVE‑2026‑4480’s pre‑auth command‑execution flaw through Samba’s printing path, but it does not provide a PoC, exploit code, or specific patch information.
🗂️ Samba CVSS 10.0: exposed SMB services are not just open ports CVE-2026-4480 and CVE-2026-4408 show how specific Samba configurations can turn file-sharing infrastructure into a remote code execution risk. Criminal IP findings: • 63,055 internet-exposed Samba assets on port 445 • Exposed services reveal SMB, NetBIOS, domain, and share information • Vulnerable smb.conf settings can increase real-world exploitability When Samba is reachable from the internet, configuration risk becomes attack surface risk. 🔎 Full analysis https://criminalip.io/knowledge-hub/blog/35176 #CyberSecurity #ThreatIntelligence #AttackSurface #Samba #SMB
Post summary
The post announces two new high‑severity Samba CVEs that enable remote code execution through misconfigured SMB services, highlights the scale of exposed assets, and calls attention to the configuration risk without providing PoC, exploits, or patch details.
🚨Upozorňujeme na zranitelnost v Samba Suite, CVE-2026-4480. Jedná se o zranitelnost typu remote code execution (RCE) s CVSS 10.0, která umožňuje neautentizovanému útočníkovi vzdálené spuštění libovolného kódu prostřednictvím tiskového subsystému Samby v případě, že je systém nakonfigurován s parametrem print command využívajícím substituci %J. Podstatou problému je nedostatečné ošetření vstupu – popis tiskové úlohy řízený klientem je předán přímo do shellu bez escapování metaznaků, což umožňuje vložit a vykonat škodlivé příkazy. Zneužití je možné zejména v konfiguracích s povoleným guest přístupem, bez nutnosti autentizace, což výrazně zvyšuje riziko kompromitace systémů a infrastruktury pro sdílení souborů a tisku. 📌Doporučujeme aktualizovat Sambu na verze 4.22.10, 4.23.8, 4.24.3 nebo novější.
Post summary
An RCE vulnerability (CVE‑2026‑4480) affecting Samba's print subsystem allows unauthenticated code execution due to unescaped %J input; the advisory recommends upgrading to the listed Samba versions.
🚨 LEGACY INFRASTRUCTURE IS STILL THE BIGGEST SECURITY RISK Samba just disclosed CVE-2026-4480. Critical severity. CVSS 10.0. Unauthenticated remote code execution. The issue is not magic. A client-controlled print job description can be passed into a shell command through the "%J" parameter in Samba’s "print command" configuration. If the server is exposed and configured badly, an attacker may be able to execute commands remotely. That means: • Full server compromise • Lateral movement • Data theft • Ransomware staging • Enterprise domain exposure This is exactly why old infrastructure keeps burning companies. Not because attackers are geniuses. Because legacy systems still run with unsafe defaults, shell-based command handling, guest access, poor segmentation, and forgotten services nobody wants to own. Patch versions: • Samba 4.22.10 • Samba 4.23.8 • Samba 4.24.3 Workaround: Remove "%J" from "smb.conf" print command configurations if patching is delayed. Now compare this with the direction $ICP is taking. @dfinity and the Internet Computer are not trying to bolt modern security onto 30-year-old infrastructure. They are building a tamper-resistant cloud protocol where applications, compute, storage, identity, and governance can run on-chain. That matters. Because the future of cyber security is not another patch cycle on fragile legacy stacks. It is reducing the attack surface completely. No centralized cloud dependency. No hidden admin server. No traditional backend to compromise. No single infrastructure owner deciding your uptime. $ICP is not just another blockchain. It is infrastructure replacement. Legacy systems keep proving the same point every week: The internet was not built securely enough. $ICP is the rebuild. #ICP #DFINITY #CyberSecurity #Samba #CVE #Web3 #DecentralizedCloud #InternetComputer Support the work / contribute: 1e672d038cebc619d93186418fa98f6499dbdb9cfdfac54f366c61a4a4ee4362
Post summary
The post announces Samba CVE‑2026‑4480, details its severity and exploitation vector, and provides patch versions and a workaround, making patching the main focus.
HTB writeup: Abducted No web server. SMB all the way to root. → Unauth RCE via Samba's print spooler (CVE-2026-4480) → Creds in an rclone config → SSH key via SMB wide-links + symlinks → Root via group-writable systemd drop-in #HackTheBox https://sp1r4.github.io/writeups/htb-abducted.html
Post summary
The writeup outlines an unauthorized RCE via Samba's print spooler CVE‑2026‑4480, describing credential grabbing and privilege escalation steps, but does not provide a PoC, exploit code, patch, or active exploitation evidence.
CVE-2026-4480: Samba print subsystem command injection via unescaped %J in shell commands, allowing unauthenticated remote code execution on reachable print shares. https://cveplayground.com/blog/cve-2026-4480-samba-print-command-job-description-rce/
Post summary
The post announces that Samba’s print subsystem suffers from an unauthenticated RCE due to unescaped %J in shell commands, and it links to a blog that likely contains PoC details.
CVE-2026-4480 turns a Samba printing workflow into a pre-auth RCE path. Hack The Box breaks down exploitation, detection, and mitigation, plus hands-on practice in the Abducted HTB Labs machine. https://okt.to/e2cg4l #HackTheBox #MSSP #CyberSecurity https://t.co/1zqz8k3zOL
Post summary
The post offers a brief explanation of CVE‑2026‑4480’s pre‑authentication remote code execution in Samba, provides learning resources via Hack The Box, but no exploit code, patch, or active exploitation claim is given.
Samba: samba: remote code execution in printing subsystem via unescaped job description CVE: CVE-2026-4480 PT ID: PT-2026-43256 Vendor: Red Hat Product: Red Hat Enterprise Linux 10 CVSS: 9.8 Credits: Arjun Basnet (Securin Labs), John Walker (ZeroPath), and Ron Ben Yizhak (SafeBreach) Description: A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-4480 • https://access.redhat.com/errata/RHSA-2026:22644 • https://access.redhat.com/errata/RHSA-2026:22963 • https://access.redhat.com/security/cve/CVE-2026-4480 • https://bugzilla.redhat.com/show_bug.cgi?id=2452232 • https://bugzilla.samba.org/show_bug.cgi?id=16033 PoC/Exploit: https://github.com/TheCyberGeek/CVE-2026-4480-PoC #dbugs_vuln
Post summary
CVE‑2026‑4480 is a remote code execution flaw in Samba’s printing subsystem; a PoC/exploit is available on GitHub, and Red Hat has issued patches via errata.
Warning: #Samba has released a security bulletin covering six #CVEs including #CVE-2026-4480 (CVSS:10.0) and #CVE-2026-4408 (CVSS:10.0). Both lead to Remote Code Execution #RCE. Find out more at https://www.samba.org/samba/history/security.html #Patch #Patch #Patch
Post summary
Samba has issued a security bulletin for six CVEs, including two with CVSS 10.0 that enable remote code execution; patches are available and referenced via the Samba security page.
critical Samba Vulnerability Enables Remote Code Execution Attacks. kernel CVEs cascade. patch the host, expect container escapes to follow within days. #RCE #AuthRCE #CVE-2026-4480 https://valtikstudios.com
Post summary
A critical Samba RCE vulnerability (CVE‑2026‑4480) is disclosed, urging immediate patching, though no PoC or exploit details are provided.
Top 5 Trending CVEs: 1 - CVE-2025-8088 2 - CVE-2026-4480 3 - CVE-2026-42271 4 - CVE-2026-23111 5 - CVE-2026-3300 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The post simply lists the top five trending CVEs and provides a link to a dashboard, without detailing any exploits, patches, or technical specifics.
🧩 Samba CVSS 10.0脆弱性分析 CVE-2026-4480／CVE-2026-4408は、特定のSamba設定下で認証なしのリモートコマンド実行につながる可能性がある重大な脆弱性です。 📌 本事例のポイント ・CVSS 10.0のRCE脆弱性 ・print commandやcheck password script設定が影響 ・SMB 445ポートの外部公開が攻撃対象領域に直結 🔎 Criminal IPインサイト ・Samba 445ポート公開資産：63,055件 ・外部公開SMBは攻撃者にとって主要なスキャン対象 ・バージョン確認だけでなくsmb.conf設定点検が重要 📄 詳細はこちら https://www.criminalip.io/ja/knowledge-hub/blog/9046 #サイバーセキュリティ #Samba #脆弱性 #攻撃対象領域管理
Post summary
The post highlights a high‑severity RCE vulnerability in Samba, outlines specific affected settings, and recommends checking smb.conf as a mitigation.
Samba の脆弱性 CVE-2026-4480 (CVSS 10.0) が FIX：リモート・コード実行の恐れ https://iototsecnews.jp/2026/05/28/samba-security-flaw-lets-attackers-execute-code-remotely/ Samba の脆弱性 CVE-2026-4480 は、 印刷ジョブの名前などを処理する “%J” というパラメータの扱いに原因があります。 ユーザーが入力した文字をシステムがチェックせずに、そのまま実行コマンドに渡してしまうため、悪意の命令が紛れ込む可能性があります。 具体的には、特別な意味を持つ文字が、そのままシェルというプログラムに受け渡される状況になっています。ご利用のチームは、ご注意ください。 #CVE20264480 #Samba #Vulnerability
Post summary
The article discloses Samba CVE-2026-4480, a remote code execution vulnerability caused by unsanitized %J parameters, noting a high CVSS score and that a fix is available.
#threatreport #HighCompleteness Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries | 20-07-2026 Source: https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve Key details below ↓ 💀Threats: Adaptixc2_tool, Supershell, Nginx_rift_vuln, Clickfix_technique, Impacket_tool, Goby_tool, 🎯Victims: Government, Universities, Healthcare, Financial services, Academic, Private sector 🏭Industry: Government, Financial, Education, Healthcare 🌐Geo: Italy, Brazil, France, Vietnam, Singapore, Australia, Chinese, South korea, United states, Indonesia, United kingdom, Ireland, New zealand 🔓CVEs: CVE-2023-27350 \[[Vulners](https://vulners.com/cve/CVE-2023-27350)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - papercut papercut_mf (<20.1.7, <21.2.11, <22.0.9) - papercut papercut_ng (<20.1.7, <21.2.11, <22.0.9) CVE-2026-4480 \[[Vulners](https://vulners.com/cve/CVE-2026-4480)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: Unknown Soft: - redhat openshift_container_platform (4.0) - samba (<4.2.1) - redhat enterprise_linux (7.0, 8.0, 9.0, 10.0) CVE-2026-26980 \[[Vulners](https://vulners.com/cve/CVE-2026-26980)] - CVSS V3.1: *9.4*, - Vulners: Exploitation: True Soft: - ghost (<6.19.1) CVE-2024-3273 \[[Vulners](https://vulners.com/cve/CVE-2024-3273)] - CVSS V3.1: *7.3*, - Vulners: Exploitation: True Soft: - dlink dns-320l_firmware (1.01.0702.2013, 1.03.0904.2013, 1.11) CVE-2026-20253 \[[Vulners](https://vulners.com/cve/CVE-2026-20253)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - splunk (<10.0.7, <10.2.4) CVE-2026-42945 \[[Vulners](https://vulners.com/cve/CVE-2026-42945)] - CVSS V3.1: *8.1*, - Vulners: Exploitation: True Soft: - f5 dos (le4.7.0, 4.8.0) - f5 nginx_gateway_fabric (le1.6.2, le2.5.1) - f5 nginx_ingress_controller (le3.7.2, le4.0.1, le5.4.1) - f5 nginx_instance_manager (le2.21.1) ... CVE-2017-10271 \[[Vulners](https://vulners.com/cve/CVE-2017-10271)] - CVSS V3.1: *7.5*, - Vulners: Exploitation: True Soft: - oracle weblogic_server (10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0) 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1190, T1583.001, T1583.003, T1588.002, T1588.005, T1595.002 🧨IOCs: - IP: 2 - File: 4 - Hash: 1 - Domain: 4 💽Software: NGINX, PaperCut, WebLogic, mysql, GoDaddy 🔢Algorithms: sha256 🔠Functions: system ⚙️Win Services: print-spooler 📜Programming Languages: golang, javascript, python #threatreport: In mid-2026, significant vulnerabilities were discovered in NGINX and Ghost CMS, leading to potential cyber exploits targeting governmental and financial institutions across eleven countries. The two primary vulnerabilities included NGINX Rift (CVE-2026-42945), a heap overflow in the NGINX rewrite module, and a blind SQL injection in the Ghost CMS Content API (CVE-2026-26980). Public exploit code for both was released shortly after their discovery, prompting attackers to develop and deploy creative methods to leverage these vulnerabilities. An exposed directory on an active Singapore-based VPS revealed the operational details of a cyber threat actor leveraging these vulnerabilities. The directory, housing a variety of exploits, contained tools for multiple attack techniques, including reverse shell setup and out-of-band (OOB) DNS callbacks to confirm malware execution. The target sectors indicated a strategic approach, primarily focusing on high-value entities like federal governments, educational institutions, healthcare providers, and financial services. The NGINX Rift vulnerability was used in targeted attempts to exploit live infrastructure. An exploitation script (http://poc.py) relied on specific memory addresses and settings that necessitated a low-security environment, indicating a phase of development rather than direct application on active targets. The actor’s exploration revealed little success during these attempts. On the other hand, the Ghost CMS exploit allowed the attacker to interact with the database without authentication, making it easier to extract sensitive information. By running a public exploit script, the actor conducted checks to identify vulnerable hosts and subsequently attempted data extraction. The implications of CVE-2026-26980 extend beyond this singular event, as it had been previously associated with larger campaigns aimed at mass exploitation. Additional exploits in the toolkit included those targeting well-known vulnerabilities in systems such as PaperCut, Oracle WebLogic, and D-Link NAS devices. The operator's use of OOB verification methods, like directing DNS queries to uniquely generated subdomains, offered a means to validate successful exploit execution despite potential network response filtering. Command and control infrastructure included the presence of widely recognized exploitation frameworks like AdaptixC2 and Supershell, although these tools were not directly linked to any specific intrusion captured in the analysis. The operational artifacts uncovered indicated a systematic approach to database exploitation, along with diligent targeting across nations including Brazil, France, South Korea, and others, primarily within sectors that handle sensitive data. While specific compromise outcomes were not confirmed in the gathered evidence, this activity exemplified a competent cyber threat actor exploiting newly discovered vulnerabilities and old, effective techniques with awareness and precision. The existence of these exploits and their deliberate targeting underscores the need for heightened vigilance and proactive defense measures within the cybersecurity landscape to mitigate similar attacks.
Post summary
The report highlights the release of public exploit code for NGINX and Ghost CMS vulnerabilities, details their technical nature, and documents attackers’ attempts to use them, with no confirmation of successful exploitation or available patches.
New advisory to triage: CVE-2026-4480. A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured… Inventory first. Panic never helps.
Post summary
The advisory offers a brief technical description of a Samba printing subsystem flaw, but provides no PoC, exploit, patch, or evidence of active exploitation.
🚨 Critical Advisory: CVE-2026-4480 in Samba printing subsystem may allow unauthenticated remote code execution via %J parameter. Users should review configs and apply updates immediately. 🔗 https://cirt.gov.jm/advisory/critical-samba-printing-subsystem-vulnerability-could-allow-unauthenticated-remote-code #CyberSecurity #Samba #VulnerabilityManagement #ThreatIntel https://t.co/JtLPItx7j7
Post summary
A new critical Samba printing subsystem vulnerability (CVE‑2026‑4480) allows unauthenticated remote code execution via the %J parameter, and users are urged to review configurations and apply updates immediately.
CVE-2026-4480 shows why MSSPs need rapid vulnerability validation and remediation. Samba is widely deployed, and speed matters when RCE flaws emerge. https://www.hackthebox.com/blog/cve-2026-4480-samba-rce-vulnerability #HackTheBox #MSSP #CyberSecurity #VulnerabilityManagement #SambaSecurity
Post summary
The post references CVE-2026-4480, noting it is a Samba RCE vulnerability, and provides a link for more information, but does not detail PoC, exploit code, active exploitation, or remediation.
⚠️ Vulnerabilidades en productos Samba ❗ CVE-2026-4480 ❗ CVE-2026-4408 ❗ CVE-2026-3012 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-samba-2/ https://t.co/tDy1a4OFXL
Post summary
Three Samba vulnerabilities (CVE-2026-4480, CVE-2026-4408, CVE-2026-3012) are announced with links to further information; no exploitation, patch, or technical details are provided in the text.
BREAKING: Fedora 44 ships Samba 4.24.3 update fixing critical CVEs including RCE flaw CVE-2026-4480 in the printing subsystem, admins urged to patch Samba and FreeIPA immediately. https://threatcluster.io/cluster/critical-samba-security-update-for-fedora-44-addresses-multi-4a9d7bd1
Post summary
Admins are urged to apply Fedora 44 updates that patch Samba and FreeIPA, fixing the CVE-2026-4480 remote code execution flaw in Samba's printing subsystem.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | redhat | enterprise_linux | 10.0 | - | - |
| OS | redhat | enterprise_linux | 7.0 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |
| App | redhat | openshift_container_platform | 4.0 | - | - |
| App | samba | samba | - | - | - |