CVE-2026-1933 json
Samba: missing access check on reparse point operations
published 2026-05-27 5 mo ago modified 2026-11-04 4 d ago also EUVD-2026-32275
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.
Patch / fix
- Red Hat Red Hat Enterprise Linux 10 0:4.23.5-109.el10_2
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:4.21.3-114.el10_0.1
- Red Hat Red Hat Enterprise Linux 8 0:4.19.4-16.el8_10
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:4.15.5-16.el8_6.1
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:4.15.5-16.el8_6.1
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:4.17.5-7.el8_8.1
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:4.17.5-7.el8_8.1
- Red Hat Red Hat Enterprise Linux 9 0:4.23.5-10.el9_8
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:4.17.5-105.el9_2.5
- Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:4.19.4-105.el9_4.4
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:4.21.3-14.el9_6.1
- Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202608241157-0
- Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202609080414-0
- Red Hat Red Hat OpenShift Container Platform 4.14 414.92.202608172040-0
- Red Hat Red Hat OpenShift Container Platform 4.15 415.92.202608180329-0
- Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202608150307-0
- Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202608250221-0
- Red Hat Red Hat OpenShift Container Platform 4.18 418.94.202608142238-0
- Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202606241344-0
- Red Hat Red Hat OpenShift Container Platform 4.20 4.20.9.6.202608121719-0
- Red Hat Red Hat OpenShift Container Platform 4.21 4.21.9.6.202608122143-0
- Red Hat Red Hat OpenShift Container Platform 4.22 4.22.9.8.202608130832-0
- samba Debian 13 2:4.22.8+dfsg-0+deb13u2
- samba Debian 14 2:4.24.3+dfsg-1
debian advisories DEBIAN-CVE-2026-1933
- samba Ubuntu 25.10 2:4.22.3+dfsg-4ubuntu2.4
- samba Ubuntu 26.04 LTS 2:4.23.6+dfsg-1ubuntu2.1
ubuntu advisories UBUNTU-CVE-2026-1933
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- samba RHEL 9 4.23.5-10.el9_8
- ctdb RHEL 9 4.23.5-10.el9_8
- libldb RHEL 9 4.23.5-10.el9_8
- ldb-tools RHEL 9 4.23.5-10.el9_8
- libnetapi RHEL 9 4.23.5-10.el9_8
- samba-libs RHEL 9 4.23.5-10.el9_8
- samba-pidl RHEL 9 4.23.5-10.el9_8
- samba-test RHEL 9 4.23.5-10.el9_8
red hat advisories RHSA-2026:28057RHSA-2026:28056RHSA-2026:28054RHSA-2026:28055RHSA-2026:28053RHSA-2026:25979
- samba SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.22.11+git.552.66cfeb7de0a-160000.1.1
- samba SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.22.9+git.506.22c03ce0781-160000.1.1
suse advisories SUSE-SU-2026:23003-1SUSE-SU-2026:23129-1SUSE-SU-2026:23152-1SUSE-SU-2026:22045-1SUSE-SU-2026:22080-1
- samba openSUSE Leap 16.0 4.22.11+git.552.66cfeb7de0a-160000.1.1
- samba openSUSE Leap 16.0 4.22.9+git.506.22c03ce0781-160000.1.1
- samba openSUSE Tumbleweed 4.23.8+git.477.f78166bceed-1.1
opensuse advisories openSUSE-SU-2026:21540-1openSUSE-SU-2026:20905-1openSUSE-SU-2026:10884-1
- samba AlmaLinux 9 4.23.5-10.el9_8
- libldb AlmaLinux 9 4.23.5-10.el9_8
- ldb-tools AlmaLinux 9 4.23.5-10.el9_8
- libnetapi AlmaLinux 9 4.23.5-10.el9_8
- samba-libs AlmaLinux 9 4.23.5-10.el9_8
- samba-pidl AlmaLinux 9 4.23.5-10.el9_8
- samba-test AlmaLinux 9 4.23.5-10.el9_8
- libwbclient AlmaLinux 9 4.23.5-10.el9_8
almalinux advisories ALSA-2026:25049ALSA-2026:22963ALSA-2026:22644
- samba Rocky Linux 9 4.23.5-10.el9_8
- samba Rocky Linux 10 4.23.5-109.el10_2
rocky linux advisories RLSA-2026:25049RLSA-2026:22963
- samba Alpine 3.23 4.22.10-r0
- samba Alpine 3.24 4.23.8-r0
alpine advisories ALPINE-CVE-2026-1933
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-1933 updated cvss 7.1
samba: Missing access check on reparse point operations
-
Red Hat Enterprise Linux 6 samba, samba4, samba4-dc, samba-swat, samba4-libs, samba4-pidl, +17 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 7 ctdb, samba, samba-dc, ctdb-tests, samba-libs, samba-pidl, +18 moreaffected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9affected: workaround, no fix available
-
Red Hat CodeReady Linux Builder EUS (v.9.6) samba-pidl 4.21.3-14.el9_6.1, samba-test 4.21.3-14.el9_6.1, samba-test-libs 4.21.3-14.el9_6.1, python3-samba-test 4.21.3-14.el9_6.1fixed: vendor fix RHSA-2026:25979
-
Red Hat Enterprise Linux AppStream (v. 8) samba-vfs-iouring 4.19.4-16.el8_10fixed: vendor fix RHSA-2026:22644
-
Red Hat Enterprise Linux AppStream (v. 9) samba-client 4.23.5-10.el9_8, samba-winexe 4.23.5-10.el9_8, samba-gpupdate 4.23.5-10.el9_8, samba-vfs-iouring 4.23.5-10.el9_8, samba-krb5-printing 4.23.5-10.el9_8, samba-winbind-clients 4.23.5-10.el9_8, +1 morefixed: vendor fix RHSA-2026:25049
-
Red Hat Enterprise Linux AppStream (v. 10) samba-client 4.23.5-109.el10_2, samba-winexe 4.23.5-109.el10_2, samba-gpupdate 4.23.5-109.el10_2, samba-vfs-iouring 4.23.5-109.el10_2, samba-krb5-printing 4.23.5-109.el10_2, samba-winbind-clients 4.23.5-109.el10_2, +1 morefixed: vendor fix RHSA-2026:22963
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) samba-vfs-iouring 4.15.5-16.el8_6.1fixed: vendor fix RHSA-2026:28057
show 32 moreshow fewer
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) samba-vfs-iouring 4.17.5-7.el8_8.1fixed: vendor fix RHSA-2026:28056
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) samba-client 4.17.5-105.el9_2.5, samba-winexe 4.17.5-105.el9_2.5, samba-vfs-iouring 4.17.5-105.el9_2.5, samba-krb5-printing 4.17.5-105.el9_2.5, samba-winbind-clients 4.17.5-105.el9_2.5, samba-winbind-krb5-locator 4.17.5-105.el9_2.5fixed: vendor fix RHSA-2026:28054
-
Red Hat Enterprise Linux AppStream E4S (v.9.4) samba-client 4.19.4-105.el9_4.4, samba-winexe 4.19.4-105.el9_4.4, samba-vfs-iouring 4.19.4-105.el9_4.4, samba-krb5-printing 4.19.4-105.el9_4.4, samba-winbind-clients 4.19.4-105.el9_4.4, samba-winbind-krb5-locator 4.19.4-105.el9_4.4fixed: vendor fix RHSA-2026:28053
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) samba-client 4.21.3-114.el10_0.1, samba-winexe 4.21.3-114.el10_0.1, samba-gpupdate 4.21.3-114.el10_0.1, samba-vfs-iouring 4.21.3-114.el10_0.1, samba-krb5-printing 4.21.3-114.el10_0.1, samba-winbind-clients 4.21.3-114.el10_0.1, +1 morefixed: vendor fix RHSA-2026:28055
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) samba-client 4.21.3-14.el9_6.1, samba-winexe 4.21.3-14.el9_6.1, samba-gpupdate 4.21.3-14.el9_6.1, samba-vfs-iouring 4.21.3-14.el9_6.1, samba-krb5-printing 4.21.3-14.el9_6.1, samba-winbind-clients 4.21.3-14.el9_6.1, +1 morefixed: vendor fix RHSA-2026:25979
-
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) samba-vfs-iouring 4.15.5-16.el8_6.1fixed: vendor fix RHSA-2026:28057
-
Red Hat Enterprise Linux AppStream TUS (v.8.8) samba-vfs-iouring 4.17.5-7.el8_8.1fixed: vendor fix RHSA-2026:28056
-
Red Hat Enterprise Linux BaseOS (v. 8) ctdb 4.19.4-16.el8_10, samba 4.19.4-16.el8_10, libnetapi 4.19.4-16.el8_10, samba-libs 4.19.4-16.el8_10, samba-pidl 4.19.4-16.el8_10, samba-test 4.19.4-16.el8_10, +22 morefixed: vendor fix RHSA-2026:22644
-
Red Hat Enterprise Linux BaseOS (v. 9) samba 4.23.5-10.el9_8, libldb 4.23.5-10.el9_8, ldb-tools 4.23.5-10.el9_8, libnetapi 4.23.5-10.el9_8, samba-libs 4.23.5-10.el9_8, libwbclient 4.23.5-10.el9_8, +15 morefixed: vendor fix RHSA-2026:25049
-
Red Hat Enterprise Linux BaseOS (v. 10) samba 4.23.5-109.el10_2, libldb 4.23.5-109.el10_2, ldb-tools 4.23.5-109.el10_2, libnetapi 4.23.5-109.el10_2, samba-libs 4.23.5-109.el10_2, libwbclient 4.23.5-109.el10_2, +15 morefixed: vendor fix RHSA-2026:22963
-
Red Hat Enterprise Linux BaseOS AUS (v.8.6) ctdb 4.15.5-16.el8_6.1, samba 4.15.5-16.el8_6.1, samba-libs 4.15.5-16.el8_6.1, samba-pidl 4.15.5-16.el8_6.1, samba-test 4.15.5-16.el8_6.1, libwbclient 4.15.5-16.el8_6.1, +15 morefixed: vendor fix RHSA-2026:28057
-
Red Hat Enterprise Linux BaseOS E4S (v.8.8) ctdb 4.17.5-7.el8_8.1, samba 4.17.5-7.el8_8.1, libnetapi 4.17.5-7.el8_8.1, samba-libs 4.17.5-7.el8_8.1, samba-pidl 4.17.5-7.el8_8.1, samba-test 4.17.5-7.el8_8.1, +22 morefixed: vendor fix RHSA-2026:28056
-
Red Hat Enterprise Linux BaseOS E4S (v.9.2) samba 4.17.5-105.el9_2.5, libnetapi 4.17.5-105.el9_2.5, samba-libs 4.17.5-105.el9_2.5, libwbclient 4.17.5-105.el9_2.5, samba-tools 4.17.5-105.el9_2.5, libsmbclient 4.17.5-105.el9_2.5, +12 morefixed: vendor fix RHSA-2026:28054
-
Red Hat Enterprise Linux BaseOS E4S (v.9.4) samba 4.19.4-105.el9_4.4, libnetapi 4.19.4-105.el9_4.4, samba-libs 4.19.4-105.el9_4.4, libwbclient 4.19.4-105.el9_4.4, samba-tools 4.19.4-105.el9_4.4, libsmbclient 4.19.4-105.el9_4.4, +12 morefixed: vendor fix RHSA-2026:28053
-
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) samba 4.21.3-114.el10_0.1, libldb 4.21.3-114.el10_0.1, ldb-tools 4.21.3-114.el10_0.1, libnetapi 4.21.3-114.el10_0.1, samba-libs 4.21.3-114.el10_0.1, libwbclient 4.21.3-114.el10_0.1, +15 morefixed: vendor fix RHSA-2026:28055
-
Red Hat Enterprise Linux BaseOS EUS (v.9.6) samba 4.21.3-14.el9_6.1, libldb 4.21.3-14.el9_6.1, ldb-tools 4.21.3-14.el9_6.1, libnetapi 4.21.3-14.el9_6.1, samba-libs 4.21.3-14.el9_6.1, libwbclient 4.21.3-14.el9_6.1, +15 morefixed: vendor fix RHSA-2026:25979
-
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) ctdb 4.15.5-16.el8_6.1, samba 4.15.5-16.el8_6.1, samba-libs 4.15.5-16.el8_6.1, samba-pidl 4.15.5-16.el8_6.1, samba-test 4.15.5-16.el8_6.1, libwbclient 4.15.5-16.el8_6.1, +15 morefixed: vendor fix RHSA-2026:28057
-
Red Hat Enterprise Linux BaseOS TUS (v.8.8) ctdb 4.17.5-7.el8_8.1, samba 4.17.5-7.el8_8.1, libnetapi 4.17.5-7.el8_8.1, samba-libs 4.17.5-7.el8_8.1, samba-pidl 4.17.5-7.el8_8.1, samba-test 4.17.5-7.el8_8.1, +22 morefixed: vendor fix RHSA-2026:28056
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) samba-pidl 4.23.5-10.el9_8, samba-test 4.23.5-10.el9_8, samba-test-libs 4.23.5-10.el9_8, python3-samba-test 4.23.5-10.el9_8fixed: vendor fix RHSA-2026:25049
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) samba-pidl 4.23.5-109.el10_2, samba-test 4.23.5-109.el10_2, samba-test-libs 4.23.5-109.el10_2, python3-samba-test 4.23.5-109.el10_2fixed: vendor fix RHSA-2026:22963
-
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) samba-pidl 4.21.3-114.el10_0.1, samba-test 4.21.3-114.el10_0.1, samba-test-libs 4.21.3-114.el10_0.1, python3-samba-test 4.21.3-114.el10_0.1fixed: vendor fix RHSA-2026:28055
-
Red Hat Enterprise Linux CRB (v. 8) samba-devel 4.19.4-16.el8_10, ctdb-debuginfo 4.19.4-16.el8_10, libnetapi-devel 4.19.4-16.el8_10, samba-debuginfo 4.19.4-16.el8_10, libwbclient-devel 4.19.4-16.el8_10, samba-debugsource 4.19.4-16.el8_10, +24 morefixed: vendor fix RHSA-2026:22644
-
Red Hat Enterprise Linux Resilient Storage (v. 9) ctdb 4.23.5-10.el9_8fixed: vendor fix RHSA-2026:25049
-
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) ctdb 4.17.5-105.el9_2.5fixed: vendor fix RHSA-2026:28054
-
Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) ctdb 4.19.4-105.el9_4.4fixed: vendor fix RHSA-2026:28053
-
Red Hat Enterprise Linux Resilient Storage EUS (v.9.6) ctdb 4.21.3-14.el9_6.1fixed: vendor fix RHSA-2026:25979
-
Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202608241157fixed: vendor fix RHSA-2026:59831
-
Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202609080414fixed: vendor fix RHSA-2026:65839
-
Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202608172040fixed: vendor fix RHSA-2026:56786
-
Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202608180329fixed: vendor fix RHSA-2026:56911
-
Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202608150307fixed: vendor fix RHSA-2026:56853
-
Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202608250221fixed: vendor fix RHSA-2026:60019
5 more fixed in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
| CISA ADP | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected products
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
- Red Hat Red Hat OpenShift Container Platform 4.12
- Red Hat Red Hat OpenShift Container Platform 4.13
- Red Hat Red Hat OpenShift Container Platform 4.14
- Red Hat Red Hat OpenShift Container Platform 4.15
- Red Hat Red Hat OpenShift Container Platform 4.16
- Red Hat Red Hat OpenShift Container Platform 4.17
- Red Hat Red Hat OpenShift Container Platform 4.18
- Red Hat Red Hat OpenShift Container Platform 4.19
- Red Hat Red Hat OpenShift Container Platform 4.20
- Red Hat Red Hat OpenShift Container Platform 4.21
- Red Hat Red Hat OpenShift Container Platform 4.22
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat OpenShift Container Platform 5
- Red Hat Red Hat OpenShift Container Platform 4
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
access.redhat.com
/errata/RHSA-2026:22644
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:22963
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:25049
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:25979
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:28053
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:28054
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:28055
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:28056
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:28057
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:29863
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54581
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54599
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54769
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:56786
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:56853
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:56911
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:57483
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:59831
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:60019
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:65839
vendor-advisory
-
bugzilla.samba.org
/show_bug.cgi?id=15992
issue-tracking, vendor-advisory
-
access.redhat.com
/security/cve/CVE-2026-1933
vdb-entry, third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2447317
issue-tracking, third-party-advisory
- security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-1933.json
Sources
- CVE List CVE-2026-1933
- NVD CVE-2026-1933
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.