CVE-2026-4408
CriticalCVSS 9.0Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
A flaw in Samba allows remote command execution due to improper escaping of shell meta-characters in the 'check password script' feature when using the %u substitution. This affects non-standard configurations with samba-dcerpcd running as a system service.
Risk Assessment
The risk includes full server compromise, leading to data theft, service disruption, or lateral movement within the network.
Recommendation
Immediately review Samba configuration and avoid using %u in 'check password script' or ensure proper escaping. Also consider disabling samba-dcerpcd as a system service.
Original NVD description (English source)
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.