# CVE-2026-1933: Samba missing access check on reparse point operations

Source: https://junglewise.ai/threats/cve-2026-1933-samba-missing-access-check-on-reparse-point-operations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-1933 · Severity: high · CVSS 7.1 · Published 2026-05-27

A security flaw has been identified in Samba, a widely used software suite that allows Linux and Unix systems to share files with Windows computers. Under certain conditions, an authorized user could modify or delete file metadata on a network share even if that share is specifically set to 'read-only' mode. This could allow an attacker to disrupt operations by making files inaccessible or redirecting users to different files, potentially leading to a service outage or data integrity issues.

Technologies: [Samba](https://junglewise.ai/threats/technologies/samba). Vendors: [Samba](https://junglewise.ai/threats/vendors/samba).

## Quick answers

**Is CVE-2026-1933 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1933 being exploited in the wild.

**How severe is CVE-2026-1933?** High severity, with a CVSS score of 7.1, published 27 May 2026.

**Which products and versions are affected?** Samba 4.1 and newer.

**Is there a fix for CVE-2026-1933?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1933 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-1933?** Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Samba's handling of NTFS-style reparse points due to missing SMB-layer access checks. On shares configured with 'read only = yes', authenticated users who possess underlying filesystem-level write permissions can still create or delete reparse point metadata via SMB operations. This bypasses the intended read-only restriction of the SMB export. An attacker can exploit this to convert files into symbolic links or other reparse point types, potentially leading to a denial of service or unauthorized modification of file behavior. The issue affects Samba versions 4.1 and newer. Patches have been developed for various branches including 4.21, 4.22, 4.23, and 4.24.

## Affected products

- Samba Samba 4.1 and newer

## Timeline

- 2026-02-04: other: Vulnerability reported to Samba developers
- 2026-05-27: disclosed: Embargo lifted and CVE published
- 2026-05-27: advisory

## References

- [https://access.redhat.com/security/cve/CVE-2026-1933](https://access.redhat.com/security/cve/CVE-2026-1933)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2447317](https://bugzilla.redhat.com/show_bug.cgi?id=2447317)
- [https://bugzilla.samba.org/show_bug.cgi?id=15992](https://bugzilla.samba.org/show_bug.cgi?id=15992)

## Related threats

- [Samba access control bypass in vfs_ceph_rgw](https://junglewise.ai/threats/cve-2026-109411-an-access-control-bypass-flaw-was-found-in-samba-s-vfs-ceph-rgw)
- [A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of…](https://junglewise.ai/threats/cve-2026-58224-a-flaw-was-found-in-samba-s-ctdb-the-clustered-database-service)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)