The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22963 advisory.

    - Security release for CVE-2026-1933 CVE-2026-2340  CVE-2026-3012       CVE-2026-4480 CVE-2026-40170 CVE-2026-4408
    - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba:
      various flaws
    - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing
    - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-     enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install     it into the local trust store without proper verification. An attacker with the ability to intercept or     redirect network traffic could exploit this behavior to supply a malicious certificate authority     certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

    A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and     classic domain controllers that use the 'check password script' feature. If this script is configured with     the %u substitution character, the client-controlled username is passed without proper escaping of shell     meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected     system. This issue primarily affects non-standard configurations where the 'check password script' is used     with %u and the samba-dcerpcd service is started as a system service.(CVE-2026-4408)

    A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description     string to the command configured with the 'print command' setting via the '%J'_x000D_     substitution character without escaping shell meta characters. A remote attacker could exploit this     vulnerability by sending a specially crafted print job description that contains unescaped shell     characters. This could lead to remote code execution on the affected system.(CVE-2026-4480)

    ['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan     Metzmacher metze () samba org', 'Release Announcements\n---------------------\n\nThis is a security     release in order to address the following defects:\n\no CVE-2026-1933:   Missing access checks on reparse     point operations\n\n                   On a share marked 'read only = yes' and\n                   on file     handles opened R/O users can set\n                   or delete the reparse point xattrs on files\n     that the user has write-access in the file\n                   system for.', 'o CVE-2026-2340:   WORM vfs     module does not block overwrites\n\n                   The WORM (Write-Once, Read Many) vfs module\n     is supposed to lock write access to shared\n                   files, so they cannot be altered after     initial\n                   writes. It was allowing files to be overwritten\n                   by     renaming a newly created file over a protected\n                   file.', 'o CVE-2026-3012:   auto-     enrolment GPO installing CA certificate over http\n                   without verification\n\n     To bootstrap a certificate chain a domain member must\n                   fetch a certificate without TLS.
    It was trusting HTTP\n                   for this when a more secure encrypted LDAP channel\n     was also available.', 'o CVE-2026-3238:   Denial of service against AD DC WINS server\n\n     The WINS server component of the Active\n                   Directory Domain controller code in Samba\n     is vulnerable to a NULL pointer dereference\n                   and crash caused by a unauthenticated     UDP\n                   packet.', 'server', ''check password script' that has the %u substitution\n     character are vulnerable to a remote code execution.', 'o CVE-2026-4480:   Unauthenticated Remote Code     Execution in Samba printing\n                   subsystem\n\n                   Samba print servers with a     'print command'\n                   that has the %J substitution character\n                   are     vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no  Douglas Bagnall douglas.bagnall ()     catalyst net nz\n   * BUG 15997: CVE-2026-2340\n   * BUG 16003: CVE-2026-3012\n   * BUG 16033:
    CVE-2026-4480\n   * BUG 16034: CVE-2026-4408\n\no  Pavel Kohout pavel () aisle com\n   * BUG 15997:
    CVE-2026-2340\n\no  Volker Lendecke vl () samba org\n   * BUG 15992: CVE-2026-1933\n   * BUG 16012:
    CVE-2026-3238\n\no  Stefan Metzmacher metze () samba org\n   * BUG 15992: CVE-2026-1933\n   * BUG     16033: CVE-2026-4480\n   * BUG 16034: CVE-2026-4408', 'has Homedir / In     passwd\n\n#######################################\nReporting bugs  Development     Discussion\n#######################################\n\nPlease discuss this release on the samba-technical     mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel     on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you     don't provide vital information to help us track down\nthe problem then you will probably be ignored.  All     bug reports should\nbe filed under the Samba 4.1 and newer product in the project's Bugzilla\ndatabase (',     ').\n\n\n======================================================================\n== Our Code, Our Bugs,     Our Responsibility.\n== The Samba Team\n==================================================================     ====\n\n\n\n================\nDownload Details\n================\n\nThe uncompressed tarballs and patch     files have been signed\nusing GnuPG (ID AA99442FB680B620).  The source code can be downloaded\nfrom:',     'The release notes are available online at:', 'Our Code, Our Bugs, Our Responsibility.\n(', ')\n\n
    --Enjoy\n                        The Samba Team'](CVE-2026-3238)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description     string to the command configured with the 'print command' setting via the '%J'     substitution character without escaping shell meta characters. A remote attacker could exploit this     vulnerability by sending a specially crafted print job description that contains unescaped shell     characters. This could lead to remote code execution on the affected system.(CVE-2026-4480)

    A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and     classic domain controllers that use the 'check password script' feature. If this script is configured with     the %u substitution character, the client-controlled username is passed without proper escaping of shell     meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected     system. This issue primarily affects non-standard configurations where the 'check password script' is used     with %u and the samba-dcerpcd service is started as a system service.(CVE-2026-4408)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the samba package has been released.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and     classic domain controllers that use the 'check password script' feature. If this script is configured with     the %u substitution character, the client-controlled username is passed without proper escaping of shell     meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected     system. This issue primarily affects non-standard configurations where the 'check password script' is used     with %u and the samba-dcerpcd service is started as a system service.(CVE-2026-4408)

    A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description     string to the command configured with the 'print command' setting via the '%J'     substitution character without escaping shell meta characters. A remote attacker could exploit this     vulnerability by sending a specially crafted print job description that contains unescaped shell     characters. This could lead to remote code execution on the affected system.(CVE-2026-4480)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2076-1 advisory.

    This update for samba fixes the following issues

    Security issues:

    - CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
    - CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
    - CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
    - CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
    - CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
    - CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

    Non security issue:

    - network:samba:STABLE/samba: 'use-kerberos=desired' broken / Dolphin requires login for Samba shares     (bsc#1255755).
    - Generated dynamic profile based on path to special 'printers' share. (bsc#1259441).
    - Fix regression 'use-kerberos=desired' broken doesn't even try to authenticate with kerberos and instead     fallsback     to NTLM (bsc#1255755).
    - Fix memory leak using cups parsed options and filename allocated when processing end of printing job     (bsc#1257200).
    - Fix manpage for 'net offlinejoin requestodj'.
    - Fix 'ctdbd socket' documentation in manpage for smb.conf
    - Fix rpc workers with long living clients from growing server      memory keytab and increasing memory used by workers (bsc#1257200).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:22963 advisory.

    * samba: Missing access check on reparse point operations (CVE-2026-1933)
      * samba: vfs_worm does not block directory modification (CVE-2026-2340)
      * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012)
      * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description     (CVE-2026-4480)
      * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
      * samba: Remote Code Execution in SAMR (CVE-2026-4408)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22963 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Missing access check on reparse point operations (CVE-2026-1933)

    * samba: vfs_worm does not block directory modification (CVE-2026-2340)

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22644 advisory.

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28056 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Missing access check on reparse point operations (CVE-2026-1933)

    * samba: vfs_worm does not block directory modification (CVE-2026-2340)

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and     classic domain controllers that use the 'check password script' feature. If this script is configured with     the %u substitution character, the client-controlled username is passed without proper escaping of shell     meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected     system. This issue primarily affects non-standard configurations where the 'check password script' is used     with %u and the samba-dcerpcd service is started as a system service.(CVE-2026-4408)

    A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description     string to the command configured with the 'print command' setting via the '%J' substitution character     without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a     specially crafted print job description that contains unescaped shell characters. This could lead to     remote code execution on the affected system.(CVE-2026-4480)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
327535	Oracle Linux 10 : samba (ELSA-2026-22963)	Nessus	Oracle Linux Local Security Checks	2026/7/17	2026/7/17	critical
346759	EulerOS 2.0 SP15 : samba (EulerOS-SA-2026-3822)	Nessus	Huawei Local Security Checks	2026/9/17	2026/9/17	critical
348046	EulerOS 2.0 SP10 : samba (EulerOS-SA-2026-3769)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	critical
322365	Photon OS 4.0: Samba PHSA-2026-4.0-1039	Nessus	PhotonOS Local Security Checks	2026/6/24	2026/6/24	critical
332922	EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-2998)	Nessus	Huawei Local Security Checks	2026/8/6	2026/8/6	critical
317755	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2026:2076-1)	Nessus	SuSE Local Security Checks	2026/5/29	2026/6/9	critical
318615	AlmaLinux 10 : samba (ALSA-2026:22963)	Nessus	Alma Linux Local Security Checks	2026/6/4	2026/6/4	critical
319544	RHEL 10 : samba (RHSA-2026:22963)	Nessus	Red Hat Local Security Checks	2026/6/6	2026/6/6	critical
320009	RockyLinux 8 : samba (RLSA-2026:22644)	Nessus	Rocky Linux Local Security Checks	2026/6/9	2026/6/9	critical
322146	RHEL 8 : samba (RHSA-2026:28056)	Nessus	Red Hat Local Security Checks	2026/6/23	2026/6/25	critical
347058	EulerOS Virtualization 2.12.1 : samba (EulerOS-SA-2026-3618)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	critical
347282	EulerOS Virtualization 2.12.0 : samba (EulerOS-SA-2026-3672)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical