---
title: Critical Samba Flaw Lets Attackers Run Commands Without Logging In
description: Critical Samba vulnerability CVE-2026-4480 allows remote code execution on Unix systems. Patch now or remove %J from smb.conf for safety.
canonical_url: https://codekeeper.co/ticker/samba-vulnerability-patch-cve-2026-4480
---

# Critical Samba Flaw Lets Attackers Run Commands Without Logging In

Critical Samba vulnerability CVE-2026-4480 allows remote code execution on Unix systems. Patch now or remove %J from smb.conf for safety.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 31, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A maximum-severity vulnerability in Samba's printing subsystem — CVE-2026-4480, CVSS 10.0 — lets unauthenticated attackers run arbitrary commands on affected Linux and Unix systems. The flaw lives in the %J substitution parameter used in print commands, which passes client-controlled input directly into a shell without escaping special characters. Only print servers whose print command actually references %J are exposed, which is why setups using printing = cups or iprint are unaffected. Samba lists every other version as vulnerable, and print servers allow guest users to print by default — so no credentials are needed. A working proof-of-concept is already public. Patches are out: Samba 4.22.10, 4.23.8 and 4.24.3 fix the issue, and anything on an older unsupported branch needs to move onto one of them. If patching isn't immediate, Samba's own workaround is to put single quotes directly around %J, which it says makes useful exploitation much less likely. Removing %J from your smb.conf print command is stronger still. Commands run in the context of the printing service rather than as root, so expect an attacker to chain a local privilege escalation next. Watch for smbd spawning shells and print job names carrying shell metacharacters. **Source:** [Cybersecurity News](https://cybersecuritynews.com/samba-rce-vulnerability/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsamba-vulnerability-patch-cve-2026-4480%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks ‘AgentCorruption’ Could Have Hijacked an AWS Region With One Prompt Oct 9, 2026](https://codekeeper.co/ticker/aws-agentcorruption-vulnerability-patched)

[New 'Bucket Hijacking' Attack Can Silently Reroute Your Cloud Data to Hackers Aug 12, 2026](https://codekeeper.co/ticker/cloud-bucket-hijacking-attack-prevention)

[Cyberattacks Magento Zero-Day Under Attack, No Adobe Fix in Sight Sep 7, 2026](https://codekeeper.co/ticker/stylesmuggler-zero-day-magento-vulnerability)

[Cyberattacks Hacker Group Claims Breach of Trump Mobile Customer Data Oct 6, 2026](https://codekeeper.co/ticker/ransomware-breach-trump-mobile-data-exposed)