Skip to main content

Samba EUVDEUVD-2026-32275

| CVE-2026-1933 MEDIUM
Improper Access Control (CWE-284)
2026-05-27 secalert@redhat.com GHSA-c866-5hw6-cqf9
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
SUSE
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat
7.1 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

3
Severity Changed
Jun 15, 2026 - 22:22 NVD
HIGH MEDIUM
CVSS changed
Jun 15, 2026 - 22:22 NVD
7.1 (HIGH) 6.5 (MEDIUM)
Analysis Generated
May 27, 2026 - 20:59 vuln.today

DescriptionNVD

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.

AnalysisAI

Access control bypass in Samba allows authenticated SMB users who hold write permissions on the underlying filesystem to create or delete NTFS-style reparse point metadata on shares configured with 'read only = yes', defeating the read-only intent of the export. Because the necessary access checks are missing at the SMB layer, an attacker can change how files behave when accessed over SMB - for example, converting a regular file into a symbolic link or another reparse-point type - yielding an integrity and availability impact (CVSS 7.1). There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none', non-automatable, with partial technical impact.

Technical ContextAI

Samba is the open-source implementation of the SMB/CIFS file-sharing protocol used to export filesystem paths to Windows and other SMB clients on Unix-like systems. Reparse points are an NTFS concept (surfaced by Samba for SMB clients) that attach special metadata to a file or directory so it can behave as a symbolic link, junction, or other redirection type rather than as ordinary data. The 'read only = yes' share parameter is meant to prevent clients from modifying content on that export. The root cause maps to CWE-284 (Improper Access Control): Samba enforces the read-only policy for normal write operations but fails to apply equivalent SMB-layer checks to the create/delete operations on reparse point metadata, so the operation is gated only by the underlying POSIX filesystem permissions rather than by the share's read-only configuration. Although the input tags this as 'Authentication Bypass', the technical behavior and CWE indicate an authorization/access-control bypass: the user is already authenticated, but the read-only authorization boundary is not enforced.

RemediationAI

No vendor-released patch version is identified in the available data, so the fixed Samba release cannot be cited with confidence - monitor the upstream Samba Bugzilla (https://bugzilla.samba.org/show_bug.cgi?id=15992) and the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-1933) and apply the fixed package as soon as your distribution publishes it. Because exploitation depends on the attacker holding write permissions on the backing filesystem, the most effective compensating control is to align the underlying POSIX/filesystem permissions with the read-only intent of the share: remove or restrict write access (owner, group, and other) on the exported directory tree for accounts that connect to read-only shares, so the SMB read-only setting is backed by actual filesystem enforcement (trade-off: this can break legitimate local/backend processes that need to write to the same path). Where reparse point / symlink behavior is not required, consider disabling symlink and reparse-point support on the affected shares (for example via the relevant 'follow symlinks'/wide-links and VFS settings), accepting that this removes any legitimate symlink functionality for those exports. Limit which users can authenticate to read-only shares and audit/monitor SMB operations on those exports for unexpected reparse-point creation or deletion.

CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

CVE-2017-1000253 HIGH POC
7.8 Oct 05

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7

CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events

CVE-2015-0240 CRITICAL POC
10.0 Feb 24

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1

CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2

CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti

Vendor StatusVendor

SUSE

Severity: High
Product Status
Image SLES15-SP7-HPC-Azure Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed

Share

EUVD-2026-32275 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy