CVE-2026-1933
High
Description
A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.
SeverityHigh
CVSS7.1
Exploit probability—
Product
Samba
PublishedMay 27, 2026
First seenMay 27, 2026
Weakness typeCWE-284Improper access control
How to fix
Update
- samba samba4.2.2 or later
Vendor advisories
- bugzilla.samba.org/show_bug.cgi?id=15992
- access.redhat.com/errata/RHSA-2026:22644
- access.redhat.com/errata/RHSA-2026:22963
- access.redhat.com/errata/RHSA-2026:25049
- access.redhat.com/errata/RHSA-2026:25979
- access.redhat.com/errata/RHSA-2026:28053
- access.redhat.com/errata/RHSA-2026:28054
- access.redhat.com/errata/RHSA-2026:28055
- access.redhat.com/errata/RHSA-2026:28056
- access.redhat.com/errata/RHSA-2026:28057
- access.redhat.com/errata/RHSA-2026:29863
- access.redhat.com/errata/RHSA-2026:54581
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba samba | 4.1.0 ≤ v < 4.2.2 | 4.2.2 |
| redhat openshift_container_platform | 4.0 | — |
| redhat enterprise_linux | 7.0, 8.0, 9.0, 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.