CVE-2026-4408

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2026
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-440839.8An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit CVE-2026-440847.5An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability CVE-2026-440879.1Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an CVE-2026-440888.6SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads CVE-2026-440899.4Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability coul CVE-2026-44096.5The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and us CVE-2026-440909.8Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access b CVE-2026-440919.1An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the sy CVE-2026-440929.1An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fe CVE-2026-440937.8A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary CVE-2026-440948.6An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including defa CVE-2026-440957.8A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary comm