The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6297 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6297-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 26, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : samba     CVE ID         : CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-3238                      CVE-2026-4408 CVE-2026-4480

    Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,     print, and login server for Unix, which might result in bypass of access     checks, overwrite of files in unintended situations using the WORM vfs     module, installing CA certificates over http without verification when     auto-enrollment GPO is enabled, denial of service or remote code     execution.

    For the oldstable distribution (bookworm), these problems have been     fixed in version 2:4.17.12+dfsg-0+deb12u4.

    For the stable distribution (trixie), these problems have been fixed in     version 2:4.22.8+dfsg-0+deb13u2.

    We recommend that you upgrade your samba packages.

    For the detailed security status of samba please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22644 advisory.

    - resolves: RHEL-156322 - Fix CVE-2026-3012
    - resolves: RHEL-161647 - Fix CVE-2026-4480
    - resolves: RHEL-177933 - Fix CVE-2026-4408

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-fc81581a79 advisory.

    Update to Samba 4.23.8 - Security fix for CVE-2026-4480, CVE-2026-2340, CVE-2026-3012, CVE-2026-1933,     CVE-2026-4408, and CVE-2026-3238

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-767:06 advisory.

    * samba: group policy certificate enrollment uses  without validation (CVE-2026-3012)
      * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description     (CVE-2026-4480)
      * samba: Remote Code Execution in SAMR (CVE-2026-4408)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has samba packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description     string to the command configured with the print command setting via the %J substitution character     without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a     specially crafted print job description that contains unescaped shell characters. This could lead to     remote code execution on the affected system. (CVE-2026-4480)

  - A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets     are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS     registration packets are inserted into a shell command and executed by the Samba Active Directory Domain     Controller's wins hook, allowing an unauthenticated network attacker to achieve remote command execution     as the Samba process. (CVE-2025-10230)

  - A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be     written into alternate data streams. This allows an authenticated user to read residual memory content     that may include sensitive data, resulting in an information disclosure vulnerability. (CVE-2025-9640)

  - A flaw was found in Samba's vfs_worm module. The module is intended to provide write-once, read-many     (WORM) protections by preventing modification of files after a configurable grace period. Due to     insufficient validation during rename operations, an authenticated user with write access to a share could     overwrite a protected file by renaming a newly created file over the existing WORM-protected file.
    (CVE-2026-2340)

  - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-     enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install     it into the local trust store without proper verification. An attacker with the ability to intercept or     redirect network traffic could exploit this behavior to supply a malicious certificate authority     certificate, potentially allowing interception or spoofing of trusted communications. (CVE-2026-3012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1514 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 9.6. It addresses 6 CVEs:
    CVE-2026-1933, CVE-2026-3012, CVE-2026-3238, CVE-2026-4480, CVE-2026-2340, and 1 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782146244 advisory.

  - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-     enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install     it into the local trust store without proper verification. An attacker with the ability to intercept or     redirect network traffic could exploit this behavior to supply a malicious certificate authority     certificate, potentially allowing interception or spoofing of trusted communications. (CVE-2026-3012)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1781101271 advisory.

  - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-     enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install     it into the local trust store without proper verification. An attacker with the ability to intercept or     redirect network traffic could exploit this behavior to supply a malicious certificate authority     certificate, potentially allowing interception or spoofing of trusted communications. (CVE-2026-3012)

  - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and     classic domain controllers that use the check password script feature. If this script is configured with     the %u substitution character, the client-controlled username is passed without proper escaping of shell     meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected     system. This issue primarily affects non-standard configurations where the check password script is used     with %u and the samba-dcerpcd service is started as a system service. (CVE-2026-4408)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2076-1 advisory.

    This update for samba fixes the following issues

    Security issues:

    - CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
    - CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
    - CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
    - CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
    - CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
    - CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

    Non security issue:

    - network:samba:STABLE/samba: 'use-kerberos=desired' broken / Dolphin requires login for Samba shares     (bsc#1255755).
    - Generated dynamic profile based on path to special 'printers' share. (bsc#1259441).
    - Fix regression 'use-kerberos=desired' broken doesn't even try to authenticate with kerberos and instead     fallsback     to NTLM (bsc#1255755).
    - Fix memory leak using cups parsed options and filename allocated when processing end of printing job     (bsc#1257200).
    - Fix manpage for 'net offlinejoin requestodj'.
    - Fix 'ctdbd socket' documentation in manpage for smb.conf
    - Fix rpc workers with long living clients from growing server      memory keytab and increasing memory used by workers (bsc#1257200).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22644 advisory.

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28056 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Missing access check on reparse point operations (CVE-2026-1933)

    * samba: vfs_worm does not block directory modification (CVE-2026-2340)

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1414 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 9.2. It addresses 10 CVEs:
    CVE-2026-3012, CVE-2020-1472, CVE-2026-3238, CVE-2026-4480, CVE-2022-38023, and 5 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22963 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Missing access check on reparse point operations (CVE-2026-1933)

    * samba: vfs_worm does not block directory modification (CVE-2026-2340)

    * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

    * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

    * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

    * samba: Remote Code Execution in SAMR (CVE-2026-4408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:22963 advisory.

    * samba: Missing access check on reparse point operations (CVE-2026-1933)
      * samba: vfs_worm does not block directory modification (CVE-2026-2340)
      * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012)
      * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description     (CVE-2026-4480)
      * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
      * samba: Remote Code Execution in SAMR (CVE-2026-4408)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
316800	Debian dsa-6297 : ctdb - security update	Nessus	Debian Local Security Checks	2026/5/26	2026/10/16	critical
318713	Oracle Linux 8 : samba (ELSA-2026-22644)	Nessus	Oracle Linux Local Security Checks	2026/6/4	2026/9/29	critical
318763	Fedora 43 : freeipa / samba (2026-fc81581a79)	Nessus	Fedora Local Security Checks	2026/6/5	2026/9/29	critical
320204	MiracleLinux 8 : samba-4.19.4-16.el8_10.ML.1 (AXSA:2026-767:06)	Nessus	Miracle Linux Local Security Checks	2026/6/9	2026/9/29	critical
343594	NewStart CGSL MAIN 7.02 : samba Multiple Vulnerabilities (NS-SA-2026-0095)	Nessus	NewStart CGSL Local Security Checks	2026/9/8	2026/9/23	critical
354651	Rocky Linux 9.6 [CIQ] Security Update: ldb-tools / libldb / libldb-devel / libnetapi / libnetapi-devel / etc Multiple Vulnerabilities (ciqsa-2026_1514)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
352531	AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2026:1782146244)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/9/30	medium
360456	CentOS Linux 8 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1781101271)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	critical
317755	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2026:2076-1)	Nessus	SuSE Local Security Checks	2026/5/29	2026/9/29	critical
320009	RockyLinux 8 : samba (RLSA-2026:22644)	Nessus	Rocky Linux Local Security Checks	2026/6/9	2026/9/29	critical
322146	RHEL 8 : samba (RHSA-2026:28056)	Nessus	Red Hat Local Security Checks	2026/6/23	2026/9/28	critical
355865	Rocky Linux 9.2 [CIQ] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc Multiple Vulnerabilities (ciqsa-2026_1414)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
319544	RHEL 10 : samba (RHSA-2026:22963)	Nessus	Red Hat Local Security Checks	2026/6/6	2026/9/29	critical
318615	AlmaLinux 10 : samba (ALSA-2026:22963)	Nessus	Alma Linux Local Security Checks	2026/6/4	2026/9/29	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical