Critical Samba Vulnerability (CVE-2026-4480) Enables Unauthenticated Remote Code Execution A severe vulnerability in Samba’s printing subsystem, tracked as CVE-2026-4480, has been disclosed, allowing unauthenticated attackers to execute arbitrary code remotely on affected systems. The flaw, assigned a CVSS score of 10.0, ranks among the most critical due to its ease of exploitation and potential impact. Samba, a widely used open-source software for file and print services in Linux and Unix environments, is vulnerable when configured with a "print command" that includes the %J substitution parameter. This parameter passes user-controlled print job descriptions directly into shell commands without proper sanitization, enabling attackers to inject malicious commands via crafted print jobs. The vulnerability stems from Samba’s failure to escape shell meta characters in the %J variable. Since many Samba deployments permit guest users to submit print jobs by default, exploitation requires no authentication, broadening the attack surface. However, systems using "printing = cups" or "printing = iprint" are unaffected, as are those that exclude the %J parameter from their configuration. Security researchers from SafeBreach, ZeroPath, and Securin Labs independently reported the flaw. The Samba Team has released patches in versions 4.22.10, 4.23.8, and 4.24.3. Temporary mitigations include enclosing the %J parameter in single quotes (‘%J’) or removing it entirely from the smb.conf file, though patching remains the most secure solution. The flaw poses significant risks to enterprise environments, particularly those relying on legacy Samba configurations or exposed print services. Successful exploitation could grant attackers full system control, facilitating data breaches, lateral movement, or ransomware deployment. Organizations are advised to audit configurations, restrict guest access, and monitor for suspicious print job activity. Given its critical severity and low complexity of exploitation, CVE-2026-4480 demands immediate attention from administrators managing Samba deployments. The incident underscores the persistent threat of command injection vulnerabilities in network-exposed services.