Is CVE-2026-44055 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44055 being exploited in the wild.

How severe is CVE-2026-44055?

High severity, with a CVSS score of 7.5, published 21 May 2026.

Which products and versions are affected?

Netatalk Project Netatalk 3.1.4 through 4.4.2.

Is there a fix for CVE-2026-44055?

A patch was published on 2026-05-21: Fixed in version 4.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44055 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44055?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44055: Netatalk shell injection in file change event notification scripts

CVE-2026-44055 · Severity: high · CVSS 7.5 · Published 2026-05-21

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) used to allow Linux and Unix systems to act as file servers for macOS clients. A security flaw in how the software handles user identity data allows an authenticated user to execute unauthorized commands on the server. This could lead to a full system compromise or unauthorized access to sensitive files stored on the network share.

Quick answers

Is CVE-2026-44055 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44055 being exploited in the wild.
How severe is CVE-2026-44055?: High severity, with a CVSS score of 7.5, published 21 May 2026.
Which products and versions are affected?: Netatalk Project Netatalk 3.1.4 through 4.4.2.
Is there a fix for CVE-2026-44055?: A patch was published on 2026-05-21: Fixed in version 4.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44055 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44055?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Netatalk versions 3.1.4 through 4.4.2 due to a bitwise-OR logic error in the handling of file change event (FCE) notifications. When FCE event command integrations are active, user identity data is appended to shell commands without proper escaping or neutralization. An authenticated attacker with an active AFP session can exploit this to achieve OS command injection, potentially executing arbitrary code with the privileges of the session user. The attack requires a specific configuration where 'fce notify script' is enabled in afp.conf and may be more prevalent in environments backed by directory services. The issue is resolved in version 4.4.3.

Affected products

Netatalk Project Netatalk 3.1.4 through 4.4.2

Timeline

2026-05-13: disclosed: Initial disclosure date reported by vendor
2026-05-21: advisory: NVD publication date
2026-05-21: patched: Fixed in version 4.4.3

References

https://netatalk.io/security/CVE-2026-44055

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.