CVE-2026-4480: Samba Printing Subsystem RCE Vulnerability

CVE-2026-4480 Overview

CVE-2026-4480 is a command injection vulnerability in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured by the print command setting through the %J substitution character. The implementation fails to escape shell metacharacters before invoking the command. A remote attacker with authenticated access to a print share can submit a print job whose description contains shell control characters. The injected payload executes in the context of the Samba print service, enabling arbitrary command execution on the host. The flaw is tracked under CWE-78, OS Command Injection.

Critical Impact

Authenticated remote attackers can achieve arbitrary command execution on Samba servers that use the print command directive with %J substitution, compromising confidentiality, integrity, and availability of the host.

Affected Products

• Samba file and print server software (specific versions to be confirmed by upstream advisory)
• Red Hat Enterprise Linux distributions packaging affected Samba builds
• Any Linux or Unix system running Samba with print command configured to use %J

Discovery Timeline

• 2026-05-26 - CVE-2026-4480 published to the National Vulnerability Database
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-4480

Vulnerability Analysis

The vulnerability resides in how smbd constructs the shell command line specified by the print command configuration directive. When Samba processes a print job, it substitutes the %J macro with the job description supplied by the client over the SMB protocol. Samba inserts this string directly into a shell command without quoting or sanitizing shell metacharacters such as backticks, semicolons, pipes, or $() constructs. The shell then interprets attacker-controlled content as executable syntax rather than literal data. Because the print command runs under the privileges of the Samba service, successful exploitation provides command execution at that privilege level. The attack changes scope from the print spooler context to the broader operating system, which explains the elevated impact across confidentiality, integrity, and availability.

Root Cause

The root cause is missing input neutralization before passing client-supplied data to a shell interpreter, a classic instance of CWE-78. Samba treats the %J job description as a trusted token during macro expansion. The product does not apply shell-quote escaping or argument-array execution. Any character with shell semantics is preserved in the final command string, breaking the boundary between code and data.

Attack Vector

An attacker authenticates to a Samba share that has printing enabled and a print command configured to reference %J. The attacker submits a print job whose description field contains shell metacharacters and an injected command payload. When smbd invokes the configured print command, the shell parses the injected sequence and executes the attacker's commands. The attack is performed over the network and requires low-privilege authenticated access. Exploitation complexity is higher because the target must use a vulnerable print command configuration that references the %J macro.

No verified public exploit code is available. The vulnerability mechanism is documented in the Samba Bug Report #16033 and the Red Hat CVE-2026-4480 Advisory.

Detection Methods for CVE-2026-4480

Indicators of Compromise

• Unexpected child processes spawned by smbd such as sh, bash, wget, curl, nc, python, or perl.
• Print job description fields in Samba logs containing shell metacharacters like `, ;, |, &, or $(.
• Outbound network connections originating from the Samba service user to attacker-controlled hosts.
• New files or scheduled tasks created shortly after print job submission events in log.smbd.

Detection Strategies

• Inspect Samba print job logs for job names that include shell control characters or command syntax.
• Monitor process ancestry on Samba hosts and alert on smbd parenting interactive shells or network utilities.
• Correlate authenticated SMB sessions with subsequent process executions to surface anomalous spawn patterns.
• Audit smb.conf across the fleet for print command directives that include the %J macro.

Monitoring Recommendations

• Forward smbd audit logs and Linux process telemetry to a centralized analytics platform for cross-host correlation.
• Enable Linux auditd rules for execve calls made by the Samba service account.
• Track changes to /etc/samba/smb.conf and printing-related include files with file integrity monitoring.

How to Mitigate CVE-2026-4480

Immediate Actions Required

• Inventory all Samba servers and identify those configured with a print command that references %J.
• Apply vendor patches as soon as they are released for your Samba distribution. Track status through the Red Hat CVE-2026-4480 Advisory.
• Restrict access to Samba print shares to trusted authenticated users only.
• Review historical print job logs for evidence of shell metacharacter injection.

Patch Information

Upstream fixes are tracked in Samba Bug Report #16033 and the corresponding Red Hat Bug Report #2452232. Distribution maintainers will ship updated Samba packages that escape shell metacharacters in the %J substitution or pass arguments without invoking a shell. Administrators should subscribe to their vendor's security feed and deploy patched packages once published.

Workarounds

• Disable printing services on Samba hosts that do not require them by setting load printers = no and removing [printers] shares.
• Replace print command configurations that use %J with commands that do not include the job description, or omit the %J macro entirely.
• Run Samba print services under a least-privilege account isolated from sensitive data and credentials.
• Restrict Samba network exposure to internal management networks using firewall rules until patches are applied.

# Configuration example: remove %J usage from print command in smb.conf
# Vulnerable example:
#   print command = /usr/local/bin/handle_job.sh %s %J
# Hardened example (omit %J entirely):
print command = /usr/local/bin/handle_job.sh %s

# Or disable printing entirely on hosts that do not need it:
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes