# Samba Printing Subsystem Remote Code Execution — CVE-2026-4480 (%J Print-Job Description Command Injection, CVSS 10.0, Unauthenticated)

> CVE-2026-4480 is a critical, unauthenticated command-injection vulnerability in the Samba printing subsystem. When an smb.conf 'print command' uses the %J substitution parameter, Samba passes the client-controlled print-job description string into a shell command without escaping shell metacharacters, yielding remote code execution. Because guest print-job submission is enabled by default in many deployments, exploitation requires no authentication. The official Samba advisory rates it CVSS v3.1 10.0.

- **Published:** 2026-05-29T00:00:00Z
- **Last reviewed:** 2026-05-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0624
- **ID:** TL-2026-0624
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-4480

## Description

CVE-2026-4480 is an OS command injection flaw (CWE-78) in the Samba file/print server's printing subsystem affecting Samba services on Linux/Unix. Samba supports administrator-defined print pipelines through the 'print command' directive in smb.conf, which is expanded with a set of percent-substitution macros and then handed to a system shell (via Samba's smbrun helper, which executes the resulting string through /bin/sh -c) for each print job. One of those macros, %J, expands to the print-job *description* — a string fully controlled by the SMB client that submits the job. Samba performs this substitution without neutralizing or quoting shell metacharacters present in the description, so any of ';', '|', '&', '&&', backticks, or '$(...)' embedded in the job description break out of the intended command and execute attacker-supplied commands in the security context of the smbd worker process.

The vulnerability is unauthenticated in practice. Many real-world Samba deployments allow guest users to submit print jobs (guest ok / map to guest configurations are common for shared printers), so an attacker who can reach TCP 445/139 can submit a crafted print job and trigger command execution without valid credentials. The CVSS v3.1 base vector published by the Samba team is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0 (Scope:Changed drives the maximum score). Note: the NVD/cvefeed entry currently lists a lower base score of 8.5 for the same vector context; this analysis follows the upstream Samba advisory's 10.0 rating, which more accurately reflects unauthenticated, default-reachable exploitation.

Exposure is configuration-gated. A system is vulnerable only when the active 'print command' actually contains the %J parameter. Deployments that use 'printing = cups' or 'printing = iprint' (which delegate to the CUPS/iPrint backends rather than a shell 'print command') are NOT affected, and neither are configurations where %J is absent from the print command. This means the blast radius depends on whether administrators customized 'print command' with %J — a non-default but documented and field-observed pattern, particularly on legacy 'printing = bsd/sysv/plp' style setups and custom print-accounting wrappers.

The flaw was independently reported under coordinated disclosure by Ron Ben Yizhak (SafeBreach), John Walker (ZeroPath), and Arjun Basnet (Securin Labs), and patched by Samba maintainers Stefan Metzmacher and Douglas Bagnall. It was fixed as part of a multi-CVE Samba security release on 2026-05-26 in versions 4.22.10, 4.23.8, and 4.24.3. As of this analysis (2026-05-29) there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation; however, because the mechanism is fully disclosed and trivially reproducible against a vulnerable configuration, rapid weaponization should be assumed and patching/mitigation treated as urgent.

Post-exploitation risk is severe: smbd workers frequently run with elevated privileges, so successful injection can lead directly to root-level or service-account code execution on file servers and, in AD DC deployments, domain controllers — enabling persistence, credential theft, lateral movement, and ransomware staging from a single unauthenticated request.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1496 Resource Hijacking

## Sources

- [Samba Security Advisory — CVE-2026-4480 (Unauthenticated RCE in printing subsystem via unescaped %J job description)](https://www.samba.org/samba/security/CVE-2026-4480.html)
- [CVE-2026-4480 — Samba: remote code execution in printing subsystem via unescaped job description](https://cvefeed.io/vuln/detail/CVE-2026-4480)
- [Critical Samba Vulnerability Enables Remote Code Execution Attacks](https://cybersecuritynews.com/samba-rce-vulnerability/)
- [Samba Printing Subsystem RCE via Unescaped Shell Metacharacters](https://www.thehackerwire.com/samba-printing-subsystem-rce-via-unescaped-shell-metacharacters/)
- [Critical Samba Flaw Allows Remote Code Execution](https://cyberpress.org/critical-samba-flaw/)
- [Samba 4.24.3, 4.23.8, and 4.22.10 released](https://www.linuxcompatible.org/story/samba-4243-4238-and-42210-released/)
- [Samba 4.24.3 — Release Notes](https://www.samba.org/samba/history/samba-4.24.3.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0624