CVE-2026-4480: Samba print server command injection via %J in "print command"
Samba passes the client-controlled print job description to the smb.conf "print command" through the %J substitution without escaping shell metacharacters, so a remote client can run commands on the server. Print servers are exposed when "print command" contains %J and printing is not set to cups or iprint; guests may print by default, so no account is needed. Samba scores it CVSS 10.0. All Samba versions are affected; the same release also fixes a similar %u injection in "check password script" (CVE-2026-4408).
- CVE-2026-4480CVE identifier
- 9.0CVSS 3.1 base score (critical)
- 13.9%EPSS: chance of exploitation in the next 30 days (higher than 97% of CVEs)
- 2026-05-26published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run the affected software and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Restart smbd (and nmbd/winbind if used): systemctl restart smbd on Debian/Ubuntu, systemctl restart smb on RHEL/SUSE.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Affected and fixed versions
Affected:
- All Samba versions before 4.22.10, 4.23.8 and 4.24.3, when "print command" uses %J and printing is not cups or iprint
Fixed in:
- Samba 4.24.3
- Samba 4.23.8
- Samba 4.22.10
Am I affected?
smbd --version
testparm -s 2>/dev/null | grep -iE '^\s*(printing|print command)\s*='
testparm -s 2>/dev/null | grep -i '%J'Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade samba samba-common-bin samba-libs
sudo systemctl restart smbd nmbdUbuntu
sudo apt update
sudo apt install --only-upgrade samba samba-common-bin samba-libs
sudo systemctl restart smbd nmbdRHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh 'samba*'
sudo systemctl restart smb nmbSUSE / openSUSE
sudo zypper refresh
sudo zypper update samba samba-client
sudo systemctl restart smb nmbBuilt from source
Upgrade to Samba 4.24.3, 4.23.8 or 4.22.10 (or apply the patches from https://www.samba.org/samba/security/) and restart the Samba daemons.General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | samba | fixed | 2:4.17.12+dfsg-0+deb12u4 |
| Debian 13 | samba | fixed | 2:4.22.8+dfsg-0+deb13u2 |
| Debian testing | samba | fixed | 2:4.24.3+dfsg-1 |
| Red Hat Enterprise Linux 9 | samba-0:4.23.5-10.el9_8 | fixed | RHSA-2026:25049 |
| Red Hat Enterprise Linux 8 | samba-0:4.19.4-16.el8_10 | fixed | RHSA-2026:22644 |
| Red Hat Enterprise Linux 6 | samba | out of support scope | |
| Red Hat Enterprise Linux 6 | samba4 | out of support scope | |
| Red Hat Enterprise Linux 10 | samba-0:4.23.5-109.el10_2 | fixed | RHSA-2026:22963 |
| Debian 13 (trixie) | samba | fixed | 2:4.22.8+dfsg-0+deb13u2 (DSA-6297-1) |
| Debian 12 (bookworm) | samba | fixed | 2:4.17.12+dfsg-0+deb12u4 (DSA-6297-1) |
| Ubuntu 26.04 LTS (resolute) | samba | fixed | 2:4.23.6+dfsg-1ubuntu2.1 (USN-8306-1) |
| Ubuntu 24.04 LTS (noble) | samba | fixed | 2:4.19.5+dfsg-4ubuntu9.6 (USN-8306-1) |
| Ubuntu 22.04 LTS (jammy) | samba | fixed | 2:4.15.13+dfsg-0ubuntu1.12 (USN-8306-1) |
| RHEL 10 | samba | fixed | 4.23.5-109.el10_2 (RHSA-2026:22963) |
| RHEL 9 | samba | fixed | 4.23.5-10.el9_8 (RHSA-2026:25049) |
| RHEL 8 | samba | fixed | 4.19.4-16.el8_10 (RHSA-2026:22644) |
| SUSE Linux Enterprise Server 16.0 | samba | fixed | 4.22.11+git.552.66cfeb7de0a-160000.1.1 |
| SUSE Linux Enterprise Server 15 SP7 | samba | fixed | 4.21.10+git.501.277ba349a01-150700.3.26.1 |
| openSUSE Leap 15.6 | samba | fixed | 4.19.8+git.473.51d12fd320c-150600.3.26.1 |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
If you cannot patch yet
- Samba: put single quotes directly around %J in "print command" (print command = ... '%J' ...); double quotes may not be enough. This makes exploitation much less likely, but option injection is still possible.
- Samba: if unsure, remove %J completely from the "print command" setting in smb.conf.
- Servers with printing = cups or printing = iprint, and servers whose "print command" has no %J, are not affected.
Related vulnerabilities
Sources
- Samba security advisory CVE-2026-4480
- Samba security releases history
- CVE record CVE-2026-4480
- Debian DSA-6297-1 samba
- Debian security tracker
- Ubuntu CVE page
- Red Hat CVE page
- SUSE CVE page
- https://access.redhat.com/errata/RHSA-2026:22644
- https://access.redhat.com/errata/RHSA-2026:22963
- https://access.redhat.com/errata/RHSA-2026:25049
- https://access.redhat.com/errata/RHSA-2026:25979
- https://access.redhat.com/errata/RHSA-2026:28053
- https://access.redhat.com/errata/RHSA-2026:28054
- https://access.redhat.com/errata/RHSA-2026:28055
- https://access.redhat.com/errata/RHSA-2026:28056
- https://access.redhat.com/errata/RHSA-2026:28057
- https://access.redhat.com/errata/RHSA-2026:28058
- https://access.redhat.com/errata/RHSA-2026:28132
- CVE-2026-4480 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.