CVE-2026-4408 Samba: remote code execution in samr

Critical 9.0 Published 28 May 2026 Updated 8 Oct 2026

Remote attackers can execute arbitrary commands on Samba servers if the check password script uses unescaped user input.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-4408?

CVE-2026-4408 is a critical command injection vulnerability in Redhat Enterprise Linux, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.

Weakness: CWE-78

Which versions are affected by CVE-2026-4408?

It affects 3 products.

Products include Redhat Enterprise Linux, Redhat Openshift Container Platform, Samba Samba.

How do I fix CVE-2026-4408?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-4408 being exploited?

There is no known exploitation of CVE-2026-4408 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2026-4408, AZL-88883, CLSA-2026-1781175722, CLSA-2026-1781181291, CLSA-2026-1781186905, CLSA-2026-1781258405 and 12 more.