Critical Samba Vulnerability (CVE-2026-4480) Enables Unauthenticated Remote Code Execution A maximum-severity flaw (CVE-2026-4480, CVSS 10.0) has been discovered in Samba’s printing subsystem, allowing unauthenticated remote attackers to execute arbitrary commands on vulnerable servers. The vulnerability stems from improper handling of the `%J` substitution character in Samba’s print command configuration, which fails to sanitize shell metacharacters in client-controlled job descriptions. Exploiting the flaw requires no credentials, as Samba print servers permit guest printing by default. Attackers with network access can achieve full remote code execution (RCE) without user interaction, posing a severe risk to enterprise environments where Samba is commonly deployed as a Windows-compatible print server on Linux/Unix systems. Affected Systems & Mitigations The flaw impacts all Samba versions where the `print command` setting includes `%J` without proper escaping. Servers using `printing = cups` or `printing = iprint` are unaffected, as are those that omit `%J` entirely. Partial mitigation is possible by wrapping `%J` in single quotes (`'%J'`), though this does not eliminate all risks. The Samba team has released patches in three stable versions: - Samba 4.22.10 - Samba 4.23.8 - Samba 4.24.3 For immediate protection, administrators are advised to upgrade or apply workarounds, such as removing `%J` from the print command or restricting guest printing access. The vulnerability was addressed by developers Stefan Metzmacher and Douglas Bagnall, with the flaw’s unauthenticated nature and Samba’s widespread use underscoring the urgency of patching.