THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-4408 (CRITICAL 9.0) — A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed

[NVD] CVE-2026-4408 (CRITICAL 9.0) — A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed

lownvdPublished 2026-05-28

CVE-2026-4408 CVSS: 9.0 CRITICAL Published: 2026-05-28T09:16:47.643

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters.

Indicators of compromise

CVE-2026-4408cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-4408