Is CVE-2026-1933 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1933 being exploited in the wild.

How severe is CVE-2026-1933?

High severity, with a CVSS score of 7.1, published 27 May 2026.

Is there a fix for CVE-2026-1933?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-1933 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-1933?

Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1933: Samba missing access check on reparse point operations

CVE-2026-1933 · Severity: high · CVSS 7.1 · Published 2026-05-27

A security flaw has been identified in Samba, a widely used software suite that allows Linux and Unix systems to share files with Windows computers. Under certain conditions, an authorized user could modify or delete file metadata on a network share even if that share is specifically set to 'read-only' mode. This could allow an attacker to disrupt operations by making files inaccessible or redirecting users to different files, potentially leading to a service outage or data integrity issues.

Technologies: Samba. Vendors: Samba.

Quick answers

Is CVE-2026-1933 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1933 being exploited in the wild.
How severe is CVE-2026-1933?: High severity, with a CVSS score of 7.1, published 27 May 2026.
Which products and versions are affected?: Samba 4.1 and newer.
Is there a fix for CVE-2026-1933?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1933 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-1933?: Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Samba's handling of NTFS-style reparse points due to missing SMB-layer access checks. On shares configured with 'read only = yes', authenticated users who possess underlying filesystem-level write permissions can still create or delete reparse point metadata via SMB operations. This bypasses the intended read-only restriction of the SMB export. An attacker can exploit this to convert files into symbolic links or other reparse point types, potentially leading to a denial of service or unauthorized modification of file behavior. The issue affects Samba versions 4.1 and newer. Patches have been developed for various branches including 4.21, 4.22, 4.23, and 4.24.

Affected products

Samba Samba 4.1 and newer

Timeline

2026-02-04: other: Vulnerability reported to Samba developers
2026-05-27: disclosed: Embargo lifted and CVE published
2026-05-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.