Is CVE-2026-4408 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4408 being exploited in the wild.

How severe is CVE-2026-4408?

Critical severity, with a CVSS score of 9, published 28 May 2026.

Is there a fix for CVE-2026-4408?

A patch was published on 2026-05-26: Samba releases 4.24.3, 4.23.8, and 4.22.10 containing fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4408 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4408?

Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4408: Samba command injection in check password script

CVE-2026-4408 · Severity: critical · CVSS 9 · Published 2026-05-28

A vulnerability in Samba, a widely used software for sharing files and printers across different operating systems, could allow an attacker to take full control of a server. The issue exists in a specific password-checking feature where user-provided names are not properly cleaned before being processed by the system. If exploited, an attacker could remotely execute malicious commands, potentially leading to data theft or a complete system takeover.

Technologies: Samba. Vendors: Samba.

Quick answers

Is CVE-2026-4408 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4408 being exploited in the wild.
How severe is CVE-2026-4408?: Critical severity, with a CVSS score of 9, published 28 May 2026.
Which products and versions are affected?: Samba 4.1 and newer.
Is there a fix for CVE-2026-4408?: A patch was published on 2026-05-26: Samba releases 4.24.3, 4.23.8, and 4.22.10 containing fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4408 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4408?: Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in Samba's SAMR DCE/RPC service, specifically within the SamValidatePasswordChange and SamValidatePasswordReset functions. When the 'check password script' in smb.conf uses the %u substitution character, Samba fails to escape shell meta-characters in the client-provided username before passing it to the shell. This allows unauthenticated remote attackers to achieve command execution. The vulnerability is exploitable in non-standard configurations where 'rpc start on demand helpers' is set to 'no' and the samba-dcerpcd service runs as a system service. Active Directory Domain Controllers are not affected as they do not expand the %u character in this context. Patches have been released for Samba versions 4.22, 4.23, and 4.24.

Affected products

Samba Samba 4.1 and newer

Timeline

2026-03-17: other: Vulnerability reported to Samba developers
2026-05-26: patched: Samba releases 4.24.3, 4.23.8, and 4.22.10 containing fixes
2026-05-28: disclosed: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.