Samba Printing Subsystem Remote Code Execution — CVE-2026-4480 (%J Print-Job Description Command Injection, CVSS 10.0, Unauthenticated) — Threadlinqs Intelligence
As of 2026-05-30, Samba Printing Subsystem Remote Code Execution — CVE-2026-4480 (%J Print-Job Description Command Injection, CVSS 10.0, Unauthenticated) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 14 indicators of compromise.
Threat ID: TL-2026-0624 · Severity: CRITICAL · CVSS: 10 · Status: MONITORING · Category: VULNERABILITY
CVE-2026-4480 is a critical, unauthenticated command-injection vulnerability in the Samba printing subsystem. When an smb.conf 'print command' uses the %J substitution parameter, Samba passes the
CVE-2026-4480 is an OS command injection flaw (CWE-78) in the Samba file/print server's printing subsystem affecting Samba services on Linux/Unix. Samba supports administrator-defined print pipelines through the 'print command' directive in smb.conf, which is expanded with a set of percent-substitution macros and then handed to a system shell (via Samba's smbrun helper, which executes the resulting string through /bin/sh -c) for each print job. One of those macros, %J, expands to the print-job *description* — a string fully controlled by the SMB client that submits the job. Samba performs this substitution without neutralizing or quoting shell metacharacters present in the description, so any of ';', '|', '&', '&&', backticks, or '$(...)' embedded in the job description break out of the intended command and execute attacker-supplied commands in the security context of the smbd worker process.
The vulnerability is unauthenticated in practice. Many real-world Samba deployments allow guest users to submit print jobs (guest ok / map to guest configurations are common for shared printers), so an attacker who can reach TCP 445/139 can submit a crafted print job and trigger command execution without valid credentials. The CVSS v3.1 base vector published by the Samba team is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0 (Scope:Changed drives the maximum score). Note: the NVD/cvefeed entry currently lists a lower base score of 8.5 for the same vector context; this analysis follows the upstream Samba advisory's 10.0 rating, which more accurately reflects unauthenticated, default-reachable exploitation.
Exposure is configuration-gated. A system is vulnerable only when the active 'print command' actually contains the %J parameter. Deployments that use 'printing = cups' or 'printing = iprint' (which delegate to the CUPS/iPrint backends rather than a shell 'print command') are NOT affected, and neither are configurations where %J is absent from the print command. This means the blast radius depends on whether administrators customized 'print command' with %J — a non-default but documented and field-observed pattern, particularly on legacy 'printing = bsd/sysv/plp' style setups and custom print-accounting wrappers.
The flaw was independently reported under coordinated disclosure by Ron Ben Yizhak (SafeBreach), John Walker (ZeroPath), and Arjun Basnet (Securin Labs), and patched by Samba maintainers Stefan Metzmacher and Douglas Bagnall. It was fixed as part of a multi-CVE Samba security release on 2026-05-26 in versions 4.22.10, 4.23.8, and 4.24.3. As of this analysis (2026-05-29) there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation; however, because the mechanism is fully disclosed and trivially reproducible against a vulnerable configuration, rapid weaponization should be assumed and patching/mitigation treated as urgent.
Post-exploitation risk is severe: smbd workers frequently run with elevated privileges, so successful injection can lead directly to root-level or service-account code execution on file servers and, in AD DC deployments, domain controllers — enabling persistence, credential theft, lateral movement, and ransomware staging from a single unauthenticated request.
Target sectors: technology, government, education, healthcare, financial, manufacturing, telecommunications, hosting
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 14 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-4480, T1588, T1190, T1059, T1203, T1543, T1053, T1068, T1070, T1036, T1003