A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A security vulnerability exists in Samba affecting versions before 4.22.10. The specific vulnerability     details have not been publicly disclosed.(CVE-2026-6949)

    A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target     account's home directory without validating the path is not a critical system directory such as /. On     affected systems, accounts with / as their home directory (a common default for system accounts) can have     this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands     as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo,     and package-manager failures). The change does not grant write access to / (which ships with restrictive     0555 permissions on RHEL), so the impact is availability loss rather than further privilege     escalation.(CVE-2026-15779)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target     account's home directory without validating the path is not a critical system directory such as /. On     affected systems, accounts with / as their home directory (a common default for system accounts) can have     this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands     as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo,     and package-manager failures). The change does not grant write access to / (which ships with restrictive     0555 permissions on RHEL), so the impact is availability loss rather than further privilege     escalation.(CVE-2026-15779)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2135 advisory.

    A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target     account's home directory without validating the path is not a critical system directory such as /. On     affected systems, accounts with / as their home directory (a common default for system accounts) can have     this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands     as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo,     and package-manager failures). The change does not grant write access to / (which ships with restrictive     0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
    (CVE-2026-15779)

    DNS signing DoS via TKEY name cache exhaustion

    NOTE: https://www.samba.org/samba/security/CVE-2026-58218-advisory.html (CVE-2026-58218)

    TSIG packet with name compression can crash DNS (CVE-2026-6949)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.10.16-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3886 advisory.

    A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target     account's home directory without validating the path is not a critical system directory such as /. On     affected systems, accounts with / as their home directory (a common default for system accounts) can have     this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands     as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo,     and package-manager failures). The change does not grant write access to / (which ships with restrictive     0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
    (CVE-2026-15779)

    Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes     (CVE-2026-58222)

    The CTDB protocol has bounds checking issues

    NOTE: https://www.samba.org/samba/security/CVE-2026-58224-advisory.html (CVE-2026-58224)

    TSIG packet with name compression can crash DNS (CVE-2026-6949)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101507 advisory.

    A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target     account's home directory without validating the path is not a critical system directory such as /. On     affected systems, accounts with / as their home directory (a common default for system accounts) can have     this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands     as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo,     and package-manager failures). The change does not grant write access to / (which ships with restrictive     0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21540-1 advisory.

    Update to 4.22.11.

    Security issues fixed:

    - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the       `user.SmbReparse` xattr (bsc#1261188).
    - CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user     with       write access (bsc#1261158).
    - CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification     (bsc#1261159).
    - CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code     can lead       to crash via crafted UDP packet (bsc#1261160).
    - CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server     (bsc#1261163).
    - CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing     subsystem       (bsc#1261161).
    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

    Other updates and bugfixes:

    - `samba-tool`: do not complain of no subcommand with `-V` (bsc#1273189, bso#15770).
    - Add `python3-cryptography` and `python3-requests` requirements for `samba-python3`.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21475-1 advisory.

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3367-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3362-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3364-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3363-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3365-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target     account's home directory without validating the path is not a critical system directory such as /. On     affected systems, accounts with / as their home directory (a common default for system accounts) can have     this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands     as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo,     and package-manager failures). The change does not grant write access to / (which ships with restrictive     0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
    (CVE-2026-15779)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365060	EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-4196)	Nessus	Huawei Local Security Checks	Local	medium
364992	EulerOS 2.0 SP11 : samba (EulerOS-SA-2026-4288)	Nessus	Huawei Local Security Checks	Local	medium
364941	EulerOS 2.0 SP11 : samba (EulerOS-SA-2026-4378)	Nessus	Huawei Local Security Checks	Local	medium
364785	EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-4105)	Nessus	Huawei Local Security Checks	Local	medium
363993	EulerOS 2.0 SP15 : samba (EulerOS-SA-2026-4016)	Nessus	Huawei Local Security Checks	Local	medium
363974	EulerOS 2.0 SP15 : samba (EulerOS-SA-2026-3950)	Nessus	Huawei Local Security Checks	Local	medium
345766	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2026-2135)	Nessus	Amazon Linux Local Security Checks	Local	medium
341891	Amazon Linux 2 : samba, --advisory ALAS2-2026-3886 (ALAS-2026-3886)	Nessus	Amazon Linux Local Security Checks	Local	high
336529	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: samba (UTSA-2026-101507)	Nessus	Unity Linux Local Security Checks	Local	medium
333510	openSUSE 16: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (openSUSE-SU-2026:21540-1)	Nessus	SuSE Local Security Checks	Local	critical
331556	openSUSE 16: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (openSUSE-SU-2026:21475-1)	Nessus	SuSE Local Security Checks	Local	high
330563	SUSE SLES12: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3367-1)	Nessus	SuSE Local Security Checks	Local	high
330560	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3362-1)	Nessus	SuSE Local Security Checks	Local	high
330553	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3364-1)	Nessus	SuSE Local Security Checks	Local	high
330549	SUSE SLED15: ctdb / ldb-tools / libldb-devel / libldb2 / libldb2-32bit / etc (SUSE-SU-2026:3363-1)	Nessus	SuSE Local Security Checks	Local	high
330538	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3365-1)	Nessus	SuSE Local Security Checks	Local	high
327209	Linux Distros Unpatched Vulnerability : CVE-2026-15779	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-15779

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

medium

critical

high

high

high

high

high

high

medium