← Back to browse · API

CVE-2026-4480

Severity
CRITICAL
CVSS
9.0
EPSS
0.1393
Risk score
40.88
CISA KEV
No
PoC
Yes
Published
2026-05-26
Modified
2026-07-15
First seen
2026-08-05
Aliases
EUVD-2026-31828, GHSA-HWWH-4HHW-H9JF
Products
Red Hat:Red Hat Enterprise Linux 10 patch: 0:4.23.5-109.el10_2, Red Hat:Red Hat Enterprise Linux 10.0 Extended Update Support patch: 0:4.21.3-114.el10_0.1, Red Hat:Red Hat Enterprise Linux 7 Extended Lifecycle Support patch: 0:4.10.16-26.el7_9.1, Red Hat:Red Hat Enterprise Linux 8 patch: 0:4.19.4-16.el8_10, Red Hat:Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support patch: 0:4.13.3-12.el8_4.1, Red Hat:Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On patch: 0:4.13.3-12.el8_4.1, Red Hat:Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support patch: 0:4.15.5-16.el8_6.1, Red Hat:Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On patch: 0:4.15.5-16.el8_6.1, Red Hat:Red Hat Enterprise Linux 8.8 Telecommunications Update Service patch: 0:4.17.5-7.el8_8.1, Red Hat:Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions patch: 0:4.17.5-7.el8_8.1, Red Hat:Red Hat Enterprise Linux 9 patch: 0:4.23.5-10.el9_8, Red Hat:Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions patch: 0:4.17.5-105.el9_2.5, Red Hat:Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions patch: 0:4.19.4-105.el9_4.4, Red Hat:Red Hat Enterprise Linux 9.6 Extended Update Support patch: 0:4.21.3-14.el9_6.1, linux, redhat:enterprise_linux, redhat:openshift_container_platform, samba:samba, suse, ubuntu
Sources
nvd CVE-2026-4480
packetstorm 7637ae588ffcdc0d0578e651|CVE-2026-4480
euvd EUVD-2026-31828
packetstorm 99be431621bcf3f63afb58ce|CVE-2026-4480
packetstorm e47564ae9f06cd34caedbc63|CVE-2026-4480
github 0e8e57245be11ecbba2f2ff5|CVE-2026-4480
packetstorm 9cd6cf2f8d0e6880ae392b7c|CVE-2026-4480
packetstorm 9468e2e34fe32323d0839c6b|CVE-2026-4480
packetstorm c8d0ab0405d08734a367f269|CVE-2026-4480

Description

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

References