Critical Samba Vulnerability Enables Remote Code Execution

A maximum-severity vulnerability has been discovered in Samba’s printing subsystem, allowing unauthenticated remote attackers to execute arbitrary commands on affected print servers.

Tracked as CVE-2026-4480 with a perfect CVSS score of 10.0, the flaw affects all versions of Samba and demands immediate attention from system administrators worldwide.

The root cause lies in how Samba handles the %J substitution character within its print command configuration setting.

Critical Samba Vulnerability 

When a print job is submitted, Samba passes the client-controlled job description string directly to the shell command defined in print command without sanitizing or escaping shell metacharacters, SafeBreach said.

This means an attacker can embed malicious shell commands inside a crafted job description string. Since Samba print servers permit guest users to print by default, no credentials are required to trigger the exploit.

A remote attacker with network access to the print server can achieve full remote code execution with no user interaction whatsoever, the worst possible attack scenario.

Not all Samba deployments are vulnerable, ZeroPath said. Servers are at risk only when the print command setting includes the %J substitution character. Importantly:

• Print servers configured with printing = cups or printing = iprint are not affected
• Servers that do not use %J in their print command setting are not affected
• Servers with %J wrapped in single quotes (e.g., '%J') face reduced but not eliminated risk, as option injection remains possible

The vulnerability is particularly dangerous in enterprise environments where Samba serves as a Windows-compatible print server on Linux or Unix systems, a common deployment in mixed-OS networks.

Patches and Mitigations

The Samba team has released security patches alongside three new stable versions addressing the defect:

Administrators should upgrade to one of these releases immediately. Patches are available at the official Samba security page.

For those unable to patch immediately, the Samba team recommends the following workarounds in smb.conf:

• Wrap %J in single quotes directly '%J' to substantially reduce exploitability (double quotes are insufficient)
• Remove %J entirely from the print command entry if printing functionality permits it
• Restrict guest printing access as an additional defensive layer

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects a network-accessible, low-complexity attack requiring zero privileges and no user interaction, with complete impact across confidentiality, integrity, and availability, earning CVE-2026-4480.

Patches were developed by Stefan Metzmacher and Douglas Bagnall of the Samba team. Given the exploit’s unauthenticated nature and Samba’s widespread enterprise adoption, patching should be treated as an emergency priority.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.