# CVE-2026-4408: Samba command injection in check password script

Source: https://junglewise.ai/threats/cve-2026-4408-samba-command-injection-in-check-password-script  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-4408 · Severity: critical · CVSS 9 · Published 2026-05-28

A vulnerability in Samba, a widely used software for sharing files and printers across different operating systems, could allow an attacker to take full control of a server. The issue exists in a specific password-checking feature where user-provided names are not properly cleaned before being processed by the system. If exploited, an attacker could remotely execute malicious commands, potentially leading to data theft or a complete system takeover.

Technologies: [Samba](https://junglewise.ai/threats/technologies/samba). Vendors: [Samba](https://junglewise.ai/threats/vendors/samba).

## Quick answers

**Is CVE-2026-4408 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4408 being exploited in the wild.

**How severe is CVE-2026-4408?** Critical severity, with a CVSS score of 9, published 28 May 2026.

**Which products and versions are affected?** Samba 4.1 and newer.

**Is there a fix for CVE-2026-4408?** A patch was published on 2026-05-26: Samba releases 4.24.3, 4.23.8, and 4.22.10 containing fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4408 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4408?** Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in Samba's SAMR DCE/RPC service, specifically within the SamValidatePasswordChange and SamValidatePasswordReset functions. When the 'check password script' in smb.conf uses the %u substitution character, Samba fails to escape shell meta-characters in the client-provided username before passing it to the shell. This allows unauthenticated remote attackers to achieve command execution. The vulnerability is exploitable in non-standard configurations where 'rpc start on demand helpers' is set to 'no' and the samba-dcerpcd service runs as a system service. Active Directory Domain Controllers are not affected as they do not expand the %u character in this context. Patches have been released for Samba versions 4.22, 4.23, and 4.24.

## Affected products

- Samba Samba 4.1 and newer

## Timeline

- 2026-03-17: other: Vulnerability reported to Samba developers
- 2026-05-26: patched: Samba releases 4.24.3, 4.23.8, and 4.22.10 containing fixes
- 2026-05-28: disclosed: Public disclosure and CVE assignment

## References

- [https://access.redhat.com/security/cve/CVE-2026-4408](https://access.redhat.com/security/cve/CVE-2026-4408)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2479762](https://bugzilla.redhat.com/show_bug.cgi?id=2479762)
- [https://bugzilla.samba.org/show_bug.cgi?id=16034](https://bugzilla.samba.org/show_bug.cgi?id=16034)

## Related threats

- [Samba access control bypass in vfs_ceph_rgw](https://junglewise.ai/threats/cve-2026-109411-an-access-control-bypass-flaw-was-found-in-samba-s-vfs-ceph-rgw)
- [A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of…](https://junglewise.ai/threats/cve-2026-58224-a-flaw-was-found-in-samba-s-ctdb-the-clustered-database-service)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)