Samba · Public exploit code

PoC published for command injection in Samba printing subsystem

Nov 04, 2026 · 1 min read

A flaw in Samba's printing subsystem (CVE-2026-4480, CVSS 9.8) lets a client-controlled print job name inject shell commands when %J is used in a custom print command. A public proof of concept exists and, in affected configurations, the impact is unauthenticated remote code execution, according to DarkWebInformer. Update to Samba 4.22.10, 4.23.8, or 4.24.3 and review print commands using %J.

By HIFY Radar newsroom Updated 11/04/2026 08:20 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codePatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A public proof of concept exploits a critical flaw (CVSS 9.8) in Samba's printing subsystem, CVE-2026-4480. A client-controlled print job name can inject commands into the server when %J is used in a custom print command. In affected configurations, the result is unauthenticated remote code execution.

Why it matters

An attacker can run code on the file and print server without credentials, opening a path to data theft, ransomware, and lateral movement. It affects Samba versions before 4.22.10, 4.23.8, and 4.24.3, a common component in corporate Linux environments. Exploitation requires a custom print command using %J.

What to do

Update Samba to 4.22.10, 4.23.8, or 4.24.3. Until done, remove %J from custom print commands and follow the detection and mitigation guidance in the PoC repository.

For the technical team

CVE: CVE-2026-4480
Affected: Samba (subsistema de impressão) · Samba < 4.22.10, < 4.23.8, and < 4.24.3, with %J in a custom print command.
Exploitation: Public PoC released, with a repository documenting the vulnerable configuration, attack path, affected versions, detection guidance, and mitigation steps. Reported by DarkWebInformer. The sources report no real-world exploitation.
Fix: Update to Samba 4.22.10, 4.23.8, or 4.24.3. Mitigation: stop using %J in custom print commands; the PoC repository lists mitigation steps.
Vector: Samba printing subsystem. Shell command injection: the client-controlled print job name reaches the shell without proper escaping when %J is used inside a custom print command, and shell metacharacters alter the executed command. Unauthenticated under affected configurations.
More details: CVSS 9.8. Unauthenticated remote code execution applies only under affected configurations, with %J in a custom print command. The PoC repository includes detection guidance.