CVE-2026-4408: Samba: remote code execution in samr

Synopsis

A shell meta-character injection flaw in Samba's "check password script" feature allows a remote, unauthenticated attacker to execute arbitrary commands on affected file servers and classic domain controllers. The vulnerability is reachable over the network and requires no credentials; exploitation is limited to non-standard configurations where the "check password script" is set with the %u substitution character and samba-dcerpcd runs as a system service. Successful exploitation gives the attacker full remote code execution on the host, with high impact to confidentiality, integrity, and availability. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Samba service over the network; the CVSS vector specifies AV:N, meaning no local access or physical proximity is required.

• AuthenticationNot required

  No credentials are needed; the attacker supplies a crafted username through the unauthenticated portion of the Samba protocol handshake.

• Victim interactionNot required

  No user interaction is required; the attacker triggers the flaw entirely through their own network requests.

• Attack complexityDetail

  Attack complexity is rated High (AC:H), meaning the attacker must contend with specific preconditions: the target must be running the "check password script" with %u substitution and have samba-dcerpcd running as a system service.

Blast Radius

• Executes arbitrary shell commands as the user running samba-dcerpcd, which in affected configurations is typically a system-level account.
• Reads sensitive files on the host including credentials, Kerberos keytabs, and any data accessible to the Samba process.
• Modifies or deletes files and configurations on the host, including shared filesystems served to domain clients.
• Crashes or disrupts the Samba service and connected domain infrastructure, affecting availability for all clients relying on the domain controller or file server.