Samba Printing Subsystem Remote Code Execution — CVE-2026-4480 (%J Print-Job Description Command Injection, CVSS 10.0, Unauthenticated)
Samba Printing Subsystem Remote Code Execution (TL-2026-0624), also tracked as Samba %J Print Command Injection, is a critical-severity software vulnerability scored CVSS 10, first published 2026-05-29. It has no confirmed attribution, affects Samba Team Samba (file/print services on Linux/Unix), references 1 CVE (CVE-2026-4480), maps to 20 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-0624
- Threat ID
- TL-2026-0624
- Also known as
- Samba %J Print Command Injection, Samba Print Job Description RCE
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-05-29
- Last reviewed
- 2026-05-29
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, government, education, healthcare, financial, manufacturing, telecommunications, hosting
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 14
CVE-2026-4480 is a critical, unauthenticated command-injection vulnerability in the Samba printing subsystem. When an smb.conf 'print command' uses the %J substitution parameter, Samba passes the client-controlled print-job description string into a shell command without escaping shell metacharacters, yielding remote code execution. Because guest print-job submission is enabled by default in many deployments, exploitation requires no authentication. The official Samba advisory rates it CVSS v3.1 10.0.
How Samba Printing Subsystem Remote Code Execution works
CVE-2026-4480 is an OS command injection flaw (CWE-78) in the Samba file/print server's printing subsystem affecting Samba services on Linux/Unix. Samba supports administrator-defined print pipelines through the 'print command' directive in smb.conf, which is expanded with a set of percent-substitution macros and then handed to a system shell (via Samba's smbrun helper, which executes the resulting string through /bin/sh -c) for each print job. One of those macros, %J, expands to the print-job *description* — a string fully controlled by the SMB client that submits the job. Samba performs this substitution without neutralizing or quoting shell metacharacters present in the description, so any of ';', '|', '&', '&&', backticks, or '$(...)' embedded in the job description break out of the intended command and execute attacker-supplied commands in the security context of the smbd worker process.
The vulnerability is unauthenticated in practice. Many real-world Samba deployments allow guest users to submit print jobs (guest ok / map to guest configurations are common for shared printers), so an attacker who can reach TCP 445/139 can submit a crafted print job and trigger command execution without valid credentials. The CVSS v3.1 base vector published by the Samba team is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0 (Scope:Changed drives the maximum score). Note: the NVD/cvefeed entry currently lists a lower base score of 8.5 for the same vector context; this analysis follows the upstream Samba advisory's 10.0 rating, which more accurately reflects unauthenticated, default-reachable exploitation.
Exposure is configuration-gated. A system is vulnerable only when the active 'print command' actually contains the %J parameter. Deployments that use 'printing = cups' or 'printing = iprint' (which delegate to the CUPS/iPrint backends rather than a shell 'print command') are NOT affected, and neither are configurations where %J is absent from the print command. This means the blast radius depends on whether administrators customized 'print command' with %J — a non-default but documented and field-observed pattern, particularly on legacy 'printing = bsd/sysv/plp' style setups and custom print-accounting wrappers.
The flaw was independently reported under coordinated disclosure by Ron Ben Yizhak (SafeBreach), John Walker (ZeroPath), and Arjun Basnet (Securin Labs), and patched by Samba maintainers Stefan Metzmacher and Douglas Bagnall. It was fixed as part of a multi-CVE Samba security release on 2026-05-26 in versions 4.22.10, 4.23.8, and 4.24.3. As of this analysis (2026-05-29) there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation; however, because the mechanism is fully disclosed and trivially reproducible against a vulnerable configuration, rapid weaponization should be assumed and patching/mitigation treated as urgent.
Post-exploitation risk is severe: smbd workers frequently run with elevated privileges, so successful injection can lead directly to root-level or service-account code execution on file servers and, in AD DC deployments, domain controllers — enabling persistence, credential theft, lateral movement, and ransomware staging from a single unauthenticated request.
MITRE ATT&CK techniques used in TL-2026-0624
Credential Access
Collection
Lateral Movement
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1486 Data Encrypted for Impact; T1496 Resource Hijacking
Resource Development
Affected products and versions in Samba Printing Subsystem Remote Code Execution
- Samba Team — Samba (file/print services on Linux/Unix)
Vulnerable versions: All versions prior to 4.22.10 (4.22.x); All versions prior to 4.23.8 (4.23.x); All versions prior to 4.24.3 (4.24.x); Configurations where 'print command' contains the %J parameter
Fixed in: 4.22.10; 4.23.8; 4.24.3
Remediation for Samba Printing Subsystem Remote Code Execution
Patches
- Upgrade to Samba 4.24.3 (4.24.x branch)
- Upgrade to Samba 4.23.8 (4.23.x branch)
- Upgrade to Samba 4.22.10 (4.22.x branch)
- Apply the corresponding fixed package from your Linux distribution's security update channel
Immediate actions
- Inventory all Samba hosts and grep smb.conf for a 'print command' line containing %J; treat any match as immediately vulnerable.
- Where patching cannot be applied at once, remove the %J parameter entirely from the 'print command' directive in smb.conf and reload Samba (most effective interim mitigation).
- Restrict SMB exposure: block TCP 139/445 from untrusted networks at the perimeter and host firewall; disable guest print-job submission.
- Hunt for smbd processes spawning /bin/sh, /bin/bash, curl, wget, nc, python, or perl child processes.
Workarounds
- Remove %J from the 'print command' in smb.conf (recommended interim fix).
- Enclose %J in single quotes ('%J') in the 'print command' — reduces but does NOT fully eliminate injection; not a substitute for patching.
- Set 'printing = cups' or 'printing = iprint' to bypass the vulnerable shell print-command path.
- Disable guest access / print-job submission to remove the unauthenticated exploitation path.
Longer-term hardening
- Migrate print handling to 'printing = cups' or 'printing = iprint', which are not affected by this flaw.
- Deploy EDR with behavioral detection for shell children of smbd and anomalous print-spool activity.
- Adopt network segmentation so file/print servers are not reachable from untrusted or internet-facing segments.
- Establish a patch SLA for Samba that tracks upstream security releases across all maintained branches.
CVEs associated with Samba Printing Subsystem Remote Code Execution
Weaknesses (CWE) in Samba Printing Subsystem Remote Code Execution
CWE-78
Timeline of Samba Printing Subsystem Remote Code Execution
- Linux distributions begin shipping patched Samba packages through their security update channels.
- Coordinated disclosure credited to Ron Ben Yizhak (SafeBreach), John Walker (ZeroPath), and Arjun Basnet (Securin Labs).
- Samba team releases fixed versions 4.22.10, 4.23.8, and 4.24.3 as part of a coordinated multi-CVE security release; fix authored by Stefan Metzmacher and Douglas Bagnall.
- CVE-2026-4480 assigned and the official Samba security advisory published, describing unauthenticated RCE in the printing subsystem via the unescaped %J job-description substitution.
- As of 2026-05-29, CVE-2026-4480 (Samba %J print-command RCE, CVSS 10.0) is patched in Samba 4.22.10/4.23.8/4.24.3 (released 2026-05-26) with distro packages following, and it has no public PoC, no confirmed in-the-wild exploitation, and no CISA KEV listing. It remains a live concern because the fully-disclosed, trivially weaponizable flaw still exposes unpatched hosts whose print command uses %J, so rapid weaponization is plausible.
- Threadlinqs Intelligence ingests and analyzes the threat; no public PoC and no confirmed in-the-wild exploitation observed at time of analysis, but trivial weaponization assessed as likely.
- Public technical reporting and news coverage (Cyber Security News, TheHackerWire, CyberPress) amplify the flaw, detailing the shell-metacharacter injection mechanism.
Sources cited for Samba Printing Subsystem Remote Code Execution
- Samba Security Advisory — CVE-2026-4480 (Unauthenticated RCE in printing subsystem via unescaped %J job description)
- CVE-2026-4480 — Samba: remote code execution in printing subsystem via unescaped job description
- Critical Samba Vulnerability Enables Remote Code Execution Attacks
- Samba Printing Subsystem RCE via Unescaped Shell Metacharacters
- Critical Samba Flaw Allows Remote Code Execution
- Samba 4.24.3, 4.23.8, and 4.22.10 released
- Samba 4.24.3 — Release Notes
Threats related to Samba Printing Subsystem Remote Code Execution
Detection coverage for TL-2026-0624
As of 2026-05-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0624 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.