{"id":"CVE-2026-4480","published":"2026-05-26T13:56:32Z","modified":"2026-09-01T12:04:44Z","title":"Samba: samba: remote code execution in printing subsystem via unescaped job description","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","tier":"core","eol":null,"affectedVersions":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","versions":["all versions"]}],"description":{"text":"A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the \"print command\" setting via the \"%J\"\nsubstitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in Red Hat Enterprise Linux 10's Samba printing subsystem passes the client-controlled job description to the configured \"print command\" via the %J substitution without escaping shell metacharacters. An unauthenticated remote attacker can exploit this by submitting a specially crafted print job description containing unescaped shell characters, leading to remote code execution, though the attack requires a high-complexity condition and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:24Z"},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.1393,"percentile":0.96538,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-07-20","exploitedFirstSeen":"2026-07-20","ransomware":false,"evidence":[{"url":"https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve","date":"2026-07-20"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Jun 4, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a2036fb506fe8123d65b94b","created":"2026-06-03"},{"name":"Known_Cve | Jun 3, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1ee53f4af43df5b5f4403e","created":"2026-06-02"},{"name":"Known_Cve | Jun 2, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1d945db4f5a5371b3864a3","created":"2026-06-01"},{"name":"Known_Cve | Jun 1, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1c426cbf0e554982e6da7a","created":"2026-05-31"},{"name":"Known_Cve | May 31, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1af0efff4b7dd243573ef5","created":"2026-05-30"},{"name":"Known_Cve | May 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a199f66a765b0a5dce00131","created":"2026-05-29"},{"name":"Known_Cve | May 29, 2026","url":"https://otx.alienvault.com/pulse/6a184eb0b82a588940895fc7","created":"2026-05-28"},{"name":"Known_Cve | May 28, 2026","url":"https://otx.alienvault.com/pulse/6a16fc6bdf8b1c1279eacd4b","created":"2026-05-27"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:22644","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22963","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25049","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25979","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28053","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28054","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28055","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28056","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28057","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28058","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28132","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4480","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452232","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=16033","tags":[]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4480.json","tags":["x_sadp-csaf-vex"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-31828","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31828","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":1,"earliest":"2026-06-05","earliestUrl":"https://github.com/TheCyberGeek/CVE-2026-4480-PoC","repos":[{"name":"TheCyberGeek/CVE-2026-4480-PoC","url":"https://github.com/TheCyberGeek/CVE-2026-4480-PoC","stars":23,"created":"2026-06-05"},{"name":"0xBlackash/CVE-2026-4480","url":"https://github.com/0xBlackash/CVE-2026-4480","stars":2,"created":"2026-06-07"},{"name":"saitoken241/CVE-2026-4480-POC","url":"https://github.com/saitoken241/CVE-2026-4480-POC","stars":2,"created":"2026-06-08"},{"name":"AlanNewberry/CVE-2026-4480-samba-print-command-injection-rce","url":"https://github.com/AlanNewberry/CVE-2026-4480-samba-print-command-injection-rce","stars":2,"created":"2026-10-03"},{"name":"robinxiang/CVE-2026-4480","url":"https://github.com/robinxiang/CVE-2026-4480","stars":1,"created":"2026-06-07"}]},"nuclei":[{"id":"CVE-2026-4480","name":"Samba Printing Subsystem - Remote Code Execution","severity":"critical","path":"javascript/cves/2026/CVE-2026-4480.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-4480.yaml"}],"first":{"date":"2026-06-05","source":"PoC-in-GitHub","url":"https://github.com/TheCyberGeek/CVE-2026-4480-PoC"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-05-26","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-4480","provenance":"source"},{"date":"2026-06-05","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/TheCyberGeek/CVE-2026-4480-PoC","provenance":"source"},{"date":"2026-07-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve","provenance":"source"}],"speed":{"daysToPublicExploit":10,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":72.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 103 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.31,"detail":"percentile 0.9654"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}