A CVSS 10.0 doesn't happen often, and when it does, you stop what you're doing. Samba's May 2026 security release fixes two unauthenticated, pre-auth remote code execution bugs that hit file servers, classic domain controllers, and print servers — no login required, no user interaction, just network reachability. If you run Samba anywhere in your environment, this one moves to the top of the queue today, not next maintenance window.

What Samba Just Released

Samba's official release history confirms the fix set: version 4.24.3, along with backports to 4.23.8 and 4.22.10, address six CVEs in one coordinated security drop — CVE-2026-4408, CVE-2026-4480, CVE-2026-2340, CVE-2026-3012, CVE-2026-3238, and CVE-2026-1933. The 4.24.3 release notes date the patch to May 26, 2026, and list access-control gaps on reparse point operations (CVE-2026-1933) alongside the two headline-grabbing RCEs. Six CVEs in a single release is a lot, but only two of them are the reason you're reading this article: CVE-2026-4408 and CVE-2026-4480.

The Two Critical Bugs, Plainly Explained

CVE-2026-4408 lives in the SAMR interface. Samba's own advisory states that file servers and classic (non-AD) domain controllers with samba-dcerpcd started as a system service and a "check password script" configured with the %u substitution character are vulnerable to remote code execution. In plain terms: if your password-change script substitutes the username straight into a shell command, and dcerpcd is running as its own system service rather than the older inetd-style spawn, an attacker who can reach SAMR can get code execution — without authenticating first.

CVE-2026-4480 is the one that earned the perfect score. Samba's advisory explains that the daemon passes the client-controlled job description string to whatever command is configured as "print command" via the %J substitution character, without escaping shell metacharacters. Independent analysis from HackTheBox doesn't mince words here: "Samba rated it CVSS 10.0, and for once the score is not marketing. The bug lived in print command, a line most admins copied out of a HOWTO years ago and never touched again." That's the uncomfortable part — this isn't some exotic feature nobody uses. It's a config line that's been pasted, unedited, into smb.conf files for two decades.

Why This Is a "Drop Everything" Bug

Both flaws share the traits that turn a vulnerability into a genuine emergency: unauthenticated, pre-auth, remotely reachable over the network, zero user interaction. There's no phishing step, no need to trick anyone into clicking a link. An attacker who can route packets to the vulnerable service owns it. Vendor coverage aggregating the release is blunt about the scope creep risk: organizations shouldn't assume a server is safe just because it doesn't expose file shares to the internet. Internal reachability is enough — and in most small-to-mid networks, internal reachability is exactly what a compromised workstation, a rogue VLAN hop, or a badly segmented guest network hands an attacker for free.

Who's Actually Exposed

Not every Samba box carries the same risk. The exposure for CVE-2026-4408 centers on:

• Samba file servers or classic (non-AD) domain controllers running samba-dcerpcd as a standalone system service
• Any "check password script" directive in smb.conf that uses the %u substitution

For CVE-2026-4480, the exposure hinges on:

• Print servers with a configured "print command" that uses %J
• Guest printing enabled — and the advisory notes this is the default on print servers
• smb.conf files inherited from old HOWTOs or templates, where the print command line was never revisited

That last point matters more than it sounds. A lot of Samba deployments running today were stood up years ago and have been patched for functionality, never re-audited for configuration hygiene. The print command line is exactly the kind of setting nobody touches once printing "just works."

One useful data point on scope: TrueNAS published an impact statement on this same release batch and found that, on their platform, the two critical CVEs simply don't apply due to platform-specific configuration differences, while two other CVEs in the batch require non-default configurations (like WORM mode) or authenticated access to matter. The lesson isn't "you're probably fine" — it's that exposure depends heavily on how your specific instance is configured, so don't skip the verification step even if you think you're on a hardened platform.

Can't Patch Right This Minute? Mitigate Now

Patching is the real fix, but if you're waiting on a maintenance window, there's a partial stopgap worth applying immediately. Samba's advisory itself notes that the printing bug "is much less dangerous if %J has single quotes directly around it, e.g. '%J', but it's still possible to inject command line options." A technical breakdown from CVE Playground confirms the mechanics: quoting stops word-splitting injection, but command-line option injection — things like a stray --format= flag getting passed to the underlying command — remains possible. So quoting buys you a reduction in blast radius, not a fix.

Practical steps to take today, in order of impact:

• Wrap %J in single quotes in your "print command" line as an interim measure — but understand this is a speed bump, not a wall.
• Disable guest printing if you don't have a hard business need for it. Since it's on by default, check explicitly — don't assume it's off.
• Audit any "check password script" entries for the %u substitution and review what that script actually does with unsanitized input.
• If samba-dcerpcd is running as a standalone system service and you don't strictly need it that way, review whether it can be constrained or reverted to the older invocation model until you patch.
• Restrict network reachability to SAMR and printing services with firewall rules — segment file/print servers away from general user VLANs if they aren't already.

None of these replace the patch. They buy you time if your change control process genuinely can't move faster than a day or two.

The Patch Path

Move to Samba 4.24.3, 4.23.8, or 4.22.10 depending on which branch you're tracking — these are the three versions the official release covers. If you're running a distribution package rather than compiling from source, check your vendor's tracker directly: Red Hat and SUSE both maintain their own advisories and backport schedules for Samba CVEs, and the version number in your package manager won't always match upstream numbering. Don't assume "I'm on the latest from my distro's repo" means "I'm patched" — confirm the CVE is actually closed against your specific package build, not just that you ran an update recently.

Also worth a mention while you're in there: the same release batch fixes CVE-2026-3012, which Samba's advisory describes as affecting domain members that fetch a certificate chain over HTTP without verification, and which has been present since version 4.16. It's not pre-auth RCE, but if you're touching Samba for the critical bugs anyway, there's no reason to leave that one unpatched.

The Broader Lesson: Audit Your smb.conf, Not Just Your Version Number

This wave of CVEs isn't really about a coding mistake in a dark corner of the SMB protocol. It's about configuration lines that have been copy-pasted from setup guides for years and never revisited. The print command directive that triggered a perfect CVSS score is a textbook example — functional, invisible, and untouched since the day someone followed a tutorial to get network printing working. Make a habit of walking through smb.conf on every Samba box you manage, checking every substitution variable (%u, %J, %m, and friends) against what actually gets passed to a shell, and asking whether default settings like guest printing are still something you need. Patching closes today's hole. Auditing stops you from building the next one yourself.

If you manage even one Samba file server or print server, stop reading and go check three things right now: your Samba version against 4.24.3/4.23.8/4.22.10, whether guest printing is enabled, and what's sitting in your print command and check password script lines. Five minutes of checking beats an unauthenticated shell on your file server.

References

• Samba Security Announcement: CVE-2026-4408 (Unauthenticated RCE in SAMR)
• Samba Security Announcement: CVE-2026-4480 (Unauthenticated RCE in printing subsystem)
• Samba Security Announcement: CVE-2026-3012 (GPO cert enrolment over HTTP)
• Samba 4.24.3 Release Notes
• Samba Release History
• TrueNAS Impact Statement: Samba 2026 Security Release
• War Room: CVE-2026-4480 analysis, HackTheBox Blog
• CVE-2026-4480 technical breakdown, CVE Playground

Image: tony_duell — BY (via Openverse)