CVE-2026-4480 Samba: samba: remote code execution in printing subsystem via unescaped job description

Critical 9.0 Published 26 May 2026 Updated 1 Sep 2026

Remote attackers can execute arbitrary code on Samba servers by sending crafted print job descriptions containing unescaped shell characters.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-4480?

CVE-2026-4480 is a critical command injection vulnerability in Redhat Enterprise Linux, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

Weakness: CWE-78

Which versions are affected by CVE-2026-4480?

It affects 3 products.

Products include Redhat Enterprise Linux, Redhat Openshift Container Platform, Samba Samba.

How do I fix CVE-2026-4480?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-4480 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4480 exists.

Public exploit code: 1 Nuclei template and 8 proofs of concept on GitHub.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2026-4480, AZL-88880, CLSA-2026-1780478501, CLSA-2026-1780503645, CLSA-2026-1780510989, CLSA-2026-1780662239 and 8 more.