by Kastro CVE-2026-4408
Red Hat Red Hat Enterprise Linux 10 — Samba: remote code execution in samr
Description · from the CVE record
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
Affected
ProductAffectedFixed inSource
Red Hat Enterprise Linux 10see advisory0:4.23.5-109.el10_2CNA
Red Hat Enterprise Linux 10.0 Extended Update Supportsee advisory0:4.21.3-114.el10_0.1CNA
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:4.10.16-26.el7_9.1CNA
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:4.10.16-26.el7_9.1CNA
Red Hat Enterprise Linux 8see advisory0:4.19.4-16.el8_10CNA
Red Hat Enterprise Linux 8see advisory0:4.19.4-16.el8_10CNA
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:4.13.3-12.el8_4.1CNA
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:4.13.3-12.el8_4.1CNA
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:4.15.5-16.el8_6.1CNA
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onsee advisory0:4.15.5-16.el8_6.1CNA
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory0:4.17.5-7.el8_8.1CNA
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory0:4.17.5-7.el8_8.1CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
redhat-SADP (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total