Samba releases updates to fix critical Remote Code Execution vulnerabilities

Samba has released security updates to address five vulnerabilities, including two critical flaws that allow for unauthenticated Remote Code Execution (RCE). The vulnerabilities affect Samba file servers and installations functioning as Active Directory domain controllers.

The most severe issues are CVE-2026-4480, located in the Samba print subsystem, and CVE-2026-4408, affecting the file server. Both carry a CVSS score of 9.0. The latter can be exploited if the ‘samba-dcerpcd’ service is running with specific non-standard configurations involving the ‘check password script’ option.

In addition to RCE risks, other identified flaws could compromise file integrity, certificate trust, or service availability. Users are advised to update to versions 4.22.10, 4.23.8, or 4.24.3 to mitigate these risks.