Critical Samba Flaw Lets Attackers Run Commands Without Logging In

Critical Samba vulnerability CVE-2026-4480 allows remote code execution on Unix systems. Patch now or remove %J from smb.conf for safety.

By Content Team

May 31, 2026

ON THIS PAGE

A maximum-severity vulnerability in Samba's printing subsystem — CVE-2026-4480, CVSS 10.0 — lets unauthenticated attackers run arbitrary commands on affected Linux and Unix systems. The flaw lives in the %J substitution parameter used in print commands, which passes client-controlled input directly into a shell without escaping special characters.

Only print servers whose print command actually references %J are exposed, which is why setups using printing = cups or iprint are unaffected. Samba lists every other version as vulnerable, and print servers allow guest users to print by default — so no credentials are needed. A working proof-of-concept is already public.

Patches are out: Samba 4.22.10, 4.23.8 and 4.24.3 fix the issue, and anything on an older unsupported branch needs to move onto one of them. If patching isn't immediate, Samba's own workaround is to put single quotes directly around %J, which it says makes useful exploitation much less likely. Removing %J from your smb.conf print command is stronger still.

Commands run in the context of the printing service rather than as root, so expect an attacker to chain a local privilege escalation next. Watch for smbd spawning shells and print job names carrying shell metacharacters.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?