A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100779 advisory.

    A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were     added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this     behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and     evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries,     resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21540-1 advisory.

    Update to 4.22.11.

    Security issues fixed:

    - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the       `user.SmbReparse` xattr (bsc#1261188).
    - CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user     with       write access (bsc#1261158).
    - CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification     (bsc#1261159).
    - CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code     can lead       to crash via crafted UDP packet (bsc#1261160).
    - CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server     (bsc#1261163).
    - CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing     subsystem       (bsc#1261161).
    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

    Other updates and bugfixes:

    - `samba-tool`: do not complain of no subcommand with `-V` (bsc#1273189, bso#15770).
    - Add `python3-cryptography` and `python3-requests` requirements for `samba-python3`.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-8e7fa96cf3 advisory.

    Update to Samba 4.23.10 (and rebuild of FreeIPA).
    Security fixes for CVE-2026-6949, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222, CVE-2026-58216 and     CVE-2026-58224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-fcd4630c0d advisory.

    Update to Samba 4.24.5 (and rebuild of FreeIPA)     Security fixes for CVE-2026-6949, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222, CVE-2026-58216 and     CVE-2026-58224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-3be8175017 advisory.

    Update to Samba 4.24.5 (and rebuild of FreeIPA)     Security fixes for CVE-2026-6949, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222, CVE-2026-58216 and     CVE-2026-58224

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21475-1 advisory.

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.22.11 / 4.24.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-209-03 advisory.

    New samba packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3367-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3362-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3364-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3363-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3365-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were     added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this     behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and     evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries,     resulting in a denial of service. (CVE-2026-58218)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6401 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6401-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 28, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : samba     CVE ID         : CVE-2026-6949 CVE-2026-58216 CVE-2026-58218 CVE-2026-58221                      CVE-2026-58222 CVE-2026-58224

    Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,     print, and login server for Unix, which might result in denial of     service, domain takeover, information disclosure or privilege     escalation.

    For the stable distribution (trixie), these problems have been fixed in     version 2:4.22.10+dfsg-0+deb13u2.

    We recommend that you upgrade your samba packages.

    For the detailed security status of samba please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
336858	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: samba (UTSA-2026-100779)	Nessus	Unity Linux Local Security Checks	Local	medium
333510	openSUSE 16: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (openSUSE-SU-2026:21540-1)	Nessus	SuSE Local Security Checks	Local	critical
333275	Fedora 43 : freeipa / samba (2026-8e7fa96cf3)	Nessus	Fedora Local Security Checks	Local	high
333154	Fedora 44 : freeipa / samba (2026-fcd4630c0d)	Nessus	Fedora Local Security Checks	Local	high
331944	Fedora 45 : freeipa / samba (2026-3be8175017)	Nessus	Fedora Local Security Checks	Local	high
331556	openSUSE 16: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (openSUSE-SU-2026:21475-1)	Nessus	SuSE Local Security Checks	Local	high
330587	Slackware Linux 15.0 / current samba Multiple Vulnerabilities (SSA:2026-209-03)	Nessus	Slackware Local Security Checks	Local	high
330563	SUSE SLES12: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3367-1)	Nessus	SuSE Local Security Checks	Local	high
330560	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3362-1)	Nessus	SuSE Local Security Checks	Local	high
330553	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3364-1)	Nessus	SuSE Local Security Checks	Local	high
330549	SUSE SLED15: ctdb / ldb-tools / libldb-devel / libldb2 / libldb2-32bit / etc (SUSE-SU-2026:3363-1)	Nessus	SuSE Local Security Checks	Local	high
330538	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3365-1)	Nessus	SuSE Local Security Checks	Local	high
330464	Linux Distros Unpatched Vulnerability : CVE-2026-58218	Nessus	Misc.	Local	medium
330422	Debian dsa-6401 : ctdb - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-58218

medium

Tenable Plugins

medium

critical

high

high

high

high

high

high

high

high

high

high

medium

high