CVE-2026-4408: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Enterprise Linux 10
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
AI Analysis
Technical Summary
This vulnerability in Samba affects Red Hat Enterprise Linux 10 when the "check password script" feature is used with the %u substitution character. The username input is not properly escaped, enabling remote attackers to perform OS command injection and execute arbitrary commands. The issue mainly impacts non-standard Samba setups running the samba-dcerpcd service as a system service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. The vendor advisory does not currently specify an available patch or remediation.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on the vulnerable system, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system. It primarily impacts Samba file servers and classic domain controllers with specific non-standard configurations. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-4408 for current remediation guidance. Until a patch is available, avoid using the "check password script" feature with the %u substitution character in Samba configurations, or ensure proper escaping of shell meta-characters in the script. Monitor vendor communications for updates on official fixes.
CVE-2026-4408: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Enterprise Linux 10
Description
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
CVSS v3.1
Score 9.0critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Samba affects Red Hat Enterprise Linux 10 when the "check password script" feature is used with the %u substitution character. The username input is not properly escaped, enabling remote attackers to perform OS command injection and execute arbitrary commands. The issue mainly impacts non-standard Samba setups running the samba-dcerpcd service as a system service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. The vendor advisory does not currently specify an available patch or remediation.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on the vulnerable system, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system. It primarily impacts Samba file servers and classic domain controllers with specific non-standard configurations. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-4408 for current remediation guidance. Until a patch is available, avoid using the "check password script" feature with the %u substitution character in Samba configurations, or ensure proper escaping of shell meta-characters in the script. Monitor vendor communications for updates on official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-03-18T21:40:14.142Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-4408","vendor":"Red Hat"}]
Threat ID: 6a180163e29bf47b50c5959d
Added to database: 5/28/2026, 8:48:35 AM
Last enriched: 5/28/2026, 9:03:41 AM
Last updated: 5/28/2026, 8:12:32 PM
Views: 25
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.