A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793266869 advisory.

  - A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege     escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-     controlled credentials file, input values are not properly sanitized before being assembled into mount     options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing     them to bypass permission checks and execute files with administrative (root) privileges.
    (CVE-2026-104715)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22170-1 advisory.

    This update for cifs-utils fixes the following issue:

    - CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c3f7378a61 advisory.

    Fix for CVE-2026-104715.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3291 advisory.

    A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege     escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-     controlled credentials file, input values are not properly sanitized before being assembled into mount     options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing     them to bypass permission checks and execute files with administrative (root) privileges.
    (CVE-2026-104715)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4897-1 advisory.

    This update for cifs-utils fixes the following issue:

    - CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cifs-utils installed on the remote host is prior to 6.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4032 advisory.

    A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege     escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-     controlled credentials file, input values are not properly sanitized before being assembled into mount     options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing     them to bypass permission checks and execute files with administrative (root) privileges.
    (CVE-2026-104715)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4819-1 advisory.

    This update for cifs-utils fixes the following issue:

    - CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege
    escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-
    controlled credentials file, input values are not properly sanitized before being assembled into mount
    options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing
    them to bypass permission checks and execute files with administrative (root) privileges.
    (CVE-2026-104715)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has a package installed that is affected by a vulnerability as referenced in the USN-8938-1 advisory.

    It was discovered that cifs-utils incorrectly handled credentials files used by privileged mount.cifs     invocations. A local attacker could possibly use this issue to inject arbitrary mount options into a     privileged mount, resulting in a privilege escalation.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7d3c824798 advisory.

    Fix for CVE-2026-104715.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c2b21d3979 advisory.

    Fix for CVE-2026-104715.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6567 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6567-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     October 16, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : cifs-utils     CVE ID         : CVE-2026-12505 CVE-2026-104715     Debian Bug     : 1140422

    Two vulnerabilities were discovered in cifs-utils, the Common Internet     File System utilities, which could result in privilege escalation.

    For the stable distribution (trixie), these problems have been fixed in     version 2:7.4-1+deb13u1.

    We recommend that you upgrade your cifs-utils packages.

    For the detailed security status of cifs-utils please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/cifs-utils

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege     escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-     controlled credentials file, input values are not properly sanitized before being assembled into mount     options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing     them to bypass permission checks and execute files with administrative (root) privileges.
    (CVE-2026-104715)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375247	CentOS Linux 7 [TuxCare] Security Update: cifs-utils / cifs-utils-devel (CENTOS7:CLSA-2026:1793266869)	Nessus	CentOS Local Security Checks	Local	high
374760	openSUSE 16: cifs-utils / cifs-utils-devel / pam_cifscreds / etc (openSUSE-SU-2026:22170-1)	Nessus	SuSE Local Security Checks	Local	high
374668	Fedora 45 : cifs-utils (2026-c3f7378a61)	Nessus	Fedora Local Security Checks	Local	high
371898	Amazon Linux 2023 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2023-2026-3291)	Nessus	Amazon Linux Local Security Checks	Local	high
371817	SUSE SLES12 Security Update : cifs-utils (SUSE-SU-2026:4897-1)	Nessus	SuSE Local Security Checks	Local	high
371806	Amazon Linux 2 : cifs-utils (ALAS-2026-4032)	Nessus	Amazon Linux Local Security Checks	Local	high
370382	SUSE SLED15 / SLES15 Security Update : cifs-utils (SUSE-SU-2026:4819-1)	Nessus	SuSE Local Security Checks	Local	high
476229	Alpine: multiple cifs-utils packages: security update to 7.4-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
476229	Alpine: multiple cifs-utils packages: security update to 7.4-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
476228	Alpine: multiple cifs-utils packages: security update to 7.5-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
476228	Alpine: multiple cifs-utils packages: security update to 7.5-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
476227	Alpine: multiple cifs-utils packages: security update to 7.1-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
476227	Alpine: multiple cifs-utils packages: security update to 7.1-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
476224	Alpine: multiple cifs-utils packages: security update to 7.3-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
476224	Alpine: multiple cifs-utils packages: security update to 7.3-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
367751	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : cifs-utils vulnerability (USN-8938-1)	Nessus	Ubuntu Local Security Checks	Local	high
367732	Fedora 44 : cifs-utils (2026-7d3c824798)	Nessus	Fedora Local Security Checks	Local	high
367727	Fedora 43 : cifs-utils (2026-c2b21d3979)	Nessus	Fedora Local Security Checks	Local	high
366504	Debian dsa-6567 : cifs-utils - security update	Nessus	Debian Local Security Checks	Local	high
366417	Linux Distros Unpatched Vulnerability : CVE-2026-104715	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-104715

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high