PT-2026-43436 · Samba+3 · Samba+3

Asim Viladi Oglu Manizada · Published 2026-05-26 · Updated 2026-06-10 · CVE-2026-1933

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Samba (affected versions not specified)

Description A flaw exists in the handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users who possess underlying filesystem write permissions can create or delete reparse point metadata through SMB operations, even on read-only exports. This allows for the modification of SMB-visible file behavior, such as converting files into symbolic links or other reparse point types.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALSA-2026:22963

ALSA-2026:25049

BDU:2026-07419

CVE-2026-1933

OPENSUSE-SU-2026:10884-1

OPENSUSE-SU-2026:20905-1

RHSA-2026:22644

RHSA-2026:22963

SUSE-SU-2026:22045-1

SUSE-SU-2026:22080-1

USN-8306-1

Affected Products

Linuxmint

Rocky Linux

Samba

Ubuntu

References · 72

• 🔥 https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-1933.json · Exploit
• https://ubuntu.com/security/CVE-2026-3238 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07419 · Security Note
• https://ubuntu.com/security/notices/USN-8306-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1933 · Security Note
• https://osv.dev/vulnerability/USN-8306-1 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-22963.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4480 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25049 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:22644 · Vendor Advisory
• https://bugzilla.samba.org/show_bug.cgi?id=15992 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-25049.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1933 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22080-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1933 · Vendor Advisory