A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25979 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Missing access check on reparse point operations (CVE-2026-1933)

    * samba: vfs_worm does not block directory modification (CVE-2026-2340)

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:25049 advisory.

    * samba: Missing access check on reparse point operations (CVE-2026-1933)

    * samba: vfs_worm does not block directory modification (CVE-2026-2340)

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25049 advisory.

    * samba: Missing access check on reparse point operations (CVE-2026-1933)
      * samba: vfs_worm does not block directory modification (CVE-2026-2340)
      * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012)
      * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description     (CVE-2026-4480)
      * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
      * samba: Remote Code Execution in SAMR (CVE-2026-4408)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22963 advisory.

    * samba: Missing access check on reparse point operations (CVE-2026-1933)

    * samba: vfs_worm does not block directory modification (CVE-2026-2340)

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.22.10. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-158-01 advisory.

    New samba packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20905-1 advisory.

    This update for samba fixes the following issues

    Security issues:

    - CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
    - CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
    - CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
    - CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
    - CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
    - CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

    Changes for samba:

    - network:samba:STABLE/samba: use-kerberos=desired broken / Dolphin requires login for Samba shares     (bsc#1255755).
    - Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
    - samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
    - VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
    - Updated to 4.22.9

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25049 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Missing access check on reparse point operations (CVE-2026-1933)

    * samba: vfs_worm does not block directory modification (CVE-2026-2340)

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22963 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Missing access check on reparse point operations (CVE-2026-1933)

    * samba: vfs_worm does not block directory modification (CVE-2026-2340)

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-fc81581a79 advisory.

    Update to Samba 4.23.8 - Security fix for CVE-2026-4480, CVE-2026-2340, CVE-2026-3012, CVE-2026-1933,     CVE-2026-4408, and CVE-2026-3238

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:22963 advisory.

    * samba: Missing access check on reparse point operations (CVE-2026-1933)
      * samba: vfs_worm does not block directory modification (CVE-2026-2340)
      * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012)
      * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description     (CVE-2026-4480)
      * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
      * samba: Remote Code Execution in SAMR (CVE-2026-4408)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7567819345 advisory.

    Update to Samba 4.24.3 - Security fix for CVE-2026-4480, CVE-2026-2340, CVE-2026-3012, CVE-2026-1933,     CVE-2026-4408, and CVE-2026-3238

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-9b08621bdc advisory.

    Update to Samba 4.24.3 - Security fix for CVE-2026-4480, CVE-2026-2340, CVE-2026-3012, CVE-2026-1933,     CVE-2026-4408, and CVE-2026-3238


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2076-1 advisory.

    This update for samba fixes the following issues

    Security issues:

    - CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
    - CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
    - CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
    - CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
    - CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
    - CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

    Non security issue:

    - network:samba:STABLE/samba: 'use-kerberos=desired' broken / Dolphin requires login for Samba shares     (bsc#1255755).
    - Generated dynamic profile based on path to special 'printers' share. (bsc#1259441).
    - Fix regression 'use-kerberos=desired' broken doesn't even try to authenticate with kerberos and instead     fallsback     to NTLM (bsc#1255755).
    - Fix memory leak using cups parsed options and filename allocated when processing end of printing job     (bsc#1257200).
    - Fix manpage for 'net offlinejoin requestodj'.
    - Fix 'ctdbd socket' documentation in manpage for smb.conf
    - Fix rpc workers with long living clients from growing server      memory keytab and increasing memory used by workers (bsc#1257200).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8306-1 advisory.

    Asim Viladi Oglu Manizada discovered that Samba incorrectly handled access checks on reparse point     operations. An attacker could possibly use this issue to modify reparse point extended attributes on files     that should have been read-only. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-1933)

    Pavel Kohout discovered that Samba's vfs_worm module did not properly block file overwrites. An attacker     could possibly use this issue to overwrite files that should have remained immutable. (CVE-2026-2340)

    Arad Inbar, Nir Somech, and Ben Grinberg discovered that Samba incorrectly handled certificate auto-     enrolment group policies over HTTP without verification. A machine-in-the-middle attacker could possibly     use this issue to install a malicious CA certificate. This issue only affected Ubuntu 24.04 LTS, Ubuntu     25.10, and Ubuntu 26.04 LTS. (CVE-2026-3012)

    Arad Inbar, Erez Cohen, Nir Somech, and Ben Grinberg discovered that Samba's Active Directory Domain     Controller WINS server could be made to crash under certain circumstances. A remote attacker could     possibly use this issue to cause a denial of service. (CVE-2026-3238)

    Ron Ben Yizhak discovered that Samba's DCE/RPC SAMR server incorrectly handled a non-default password     check script configuration. A remote attacker could possibly use this issue to execute arbitrary code.
    (CVE-2026-4408)

    Ron Ben Yizhak discovered that Samba's printing subsystem incorrectly handled a non-default print command     configuration. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-4480)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Samba's handling of NTFS-style reparse points on shares configured with read only =     yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write     permissions may create or delete reparse point metadata through SMB operations even on read-only exports.
    This could allow modification of SMB-visible file behavior, including converting files into symbolic links     or other reparse point types. (CVE-2026-1933)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6297 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6297-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 26, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : samba     CVE ID         : CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-3238                      CVE-2026-4408 CVE-2026-4480

    Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,     print, and login server for Unix, which might result in bypass of access     checks, overwrite of files in unintended situations using the WORM vfs     module, installing CA certificates over http without verification when     auto-enrollment GPO is enabled, denial of service or remote code     execution.

    For the oldstable distribution (bookworm), these problems have been     fixed in version 2:4.17.12+dfsg-0+deb12u4.

    For the stable distribution (trixie), these problems have been fixed in     version 2:4.22.8+dfsg-0+deb13u2.

    We recommend that you upgrade your samba packages.

    For the detailed security status of samba please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
321131	RHEL 9 : samba (RHSA-2026:25979)	Nessus	Red Hat Local Security Checks	critical
320953	RockyLinux 9 : samba (RLSA-2026:25049)	Nessus	Rocky Linux Local Security Checks	critical
320648	AlmaLinux 9 : samba (ALSA-2026:25049)	Nessus	Alma Linux Local Security Checks	critical
320610	RockyLinux 10 : samba (RLSA-2026:22963)	Nessus	Rocky Linux Local Security Checks	critical
320478	Slackware Linux 15.0 samba Multiple Vulnerabilities (SSA:2026-158-01)	Nessus	Slackware Local Security Checks	critical
320420	openSUSE 16 Security Update : samba (openSUSE-SU-2026:20905-1)	Nessus	SuSE Local Security Checks	critical
320371	RHEL 9 : samba (RHSA-2026:25049)	Nessus	Red Hat Local Security Checks	critical
319544	RHEL 10 : samba (RHSA-2026:22963)	Nessus	Red Hat Local Security Checks	critical
318763	Fedora 43 : freeipa / samba (2026-fc81581a79)	Nessus	Fedora Local Security Checks	critical
318615	AlmaLinux 10 : samba (ALSA-2026:22963)	Nessus	Alma Linux Local Security Checks	critical
318168	Fedora 44 : freeipa / samba (2026-7567819345)	Nessus	Fedora Local Security Checks	critical
317804	Fedora 45 : freeipa / samba (2026-9b08621bdc)	Nessus	Fedora Local Security Checks	critical
317755	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2026:2076-1)	Nessus	SuSE Local Security Checks	critical
317099	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Samba vulnerabilities (USN-8306-1)	Nessus	Ubuntu Local Security Checks	critical
316851	Linux Distros Unpatched Vulnerability : CVE-2026-1933	Nessus	Misc.	medium
316800	Debian dsa-6297 : ctdb - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2026-1933

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical