CVE-2026-1933: 
Samba vulnerability analysis and mitigation

CVE-2026-1933 is a missing SMB-layer access control vulnerability in Samba's handling of NTFS-style reparse points on shares configured with read only = yes. Authenticated users who possess underlying filesystem write permissions can create or delete reparse point metadata via SMB operations even on read-only exports, potentially converting files into symbolic links or other reparse point types. The vulnerability was reported internally on 2026-03-13, with the embargo lifted and public disclosure occurring on 2026-05-27. Affected Samba versions span 4.1.0 through before 4.2.2 per CPE data, and the flaw also affects Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4. It carries a CVSS v3.1 base score of 6.5 (Medium/High) per NVD (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-284 (Improper Access Control): Samba fails to enforce SMB-layer write restrictions when processing IOCTL or SET_REPARSE_POINT operations on shares marked read only = yes. Because the access check is absent at the SMB protocol layer, the server relies solely on the underlying filesystem permissions, allowing an authenticated user with filesystem-level write access to bypass the share-level read-only restriction. This enables the attacker to create, modify, or delete NTFS-style reparse point metadata — including converting regular files into symbolic links — through standard SMB operations over the network. The attack vector is network-based, requires low privileges (valid SMB credentials), and no user interaction (Red Hat CVE, Samba Bugzilla).

Successful exploitation primarily affects integrity: an authenticated attacker can manipulate SMB-visible file behavior on shares that administrators intended to be read-only, including redirecting file access via symbolic links or other reparse point types. This could facilitate unauthorized data access, path traversal attacks, or tampering with files that other users or services subsequently read from the share. There is no direct confidentiality or availability impact per the CVSS scoring, but the ability to plant symbolic links could enable indirect data exfiltration or privilege escalation depending on server configuration (Red Hat CVE, Red Hat Errata).

1. Reconnaissance: Identify Samba servers exposing SMB shares configured with read only = yes using network scanning tools (e.g., nmap with SMB scripts, smbclient -L). Confirm the Samba version is in the affected range (4.1.0 to before 4.2.2).
2. Authenticate: Obtain valid SMB credentials for an account that also has underlying filesystem write permissions on the target share (e.g., a domain user whose home directory or a shared folder is writable at the OS level).
3. Connect to the share: Use an SMB client (e.g., smbclient, Windows Explorer, or a custom SMB library such as impacket) to connect to the read-only share.
4. Issue reparse point operation: Send an SMB IOCTL request (specifically FSCTL_SET_REPARSE_POINT) targeting a file on the share. Because the SMB layer does not enforce the read only restriction for this operation, the server processes the request using only filesystem-level permissions.
5. Create malicious reparse point: Set the reparse point metadata to convert the target file into a symbolic link pointing to a sensitive file or directory (e.g., /etc/shadow, another user's home directory, or a service configuration file).
6. Leverage the symlink: When other users or services access the now-redirected file path over SMB, they may inadvertently read from or write to the attacker-controlled target, enabling data exfiltration or further privilege escalation (Red Hat CVE, Samba Bugzilla).

• Network: Unexpected SMB IOCTL requests (specifically FSCTL_SET_REPARSE_POINT or FSCTL_DELETE_REPARSE_POINT) originating from authenticated clients on shares configured as read-only; SMB traffic to/from unusual client IPs on port 445.
• File System: Presence of reparse point metadata or symbolic links on files within Samba shares that are configured read only = yes; unexpected .lnk-style or junction entries in share directories; files whose attributes have changed to include the reparse point flag (FILE_ATTRIBUTE_REPARSE_POINT).
• Logs: Samba audit logs (log level = 2 or higher) showing set_reparse_point or related VFS operations on read-only shares from authenticated users; entries in /var/log/samba/log.smbd indicating IOCTL operations on read-only exports.
• Process: Unusual access patterns where a user account with limited share permissions is observed reading files outside their expected scope, potentially indicating symlink traversal following reparse point creation (Red Hat CVE).

Red Hat has addressed this vulnerability for Red Hat Enterprise Linux 10 via security advisory RHSA-2026:22963, providing updated Samba packages at version samba-4.23.5-109.el10_2. Upstream Samba releases 4.22.3, 4.23.8, and 4.22.10 were also published to address this and related issues. Administrators should apply the available patches as the primary remediation. As a temporary workaround where patching is not immediately possible, consider restricting SMB share access so that users with underlying filesystem write permissions are not granted access to read-only shares, or disable NTFS reparse point support in the Samba configuration if not required (nt acl support = no or restricting VFS modules) (Red Hat Errata, Samba News).

The vulnerability was disclosed as part of a broader Samba security release in late May 2026 that included several other CVEs, some rated Critical (e.g., CVE-2026-4408 and CVE-2026-4480 involving remote code execution). Security news outlets such as SecurityOnline.info covered the batch release under the headline "Critical Samba Vulnerabilities" (SecurityOnline). Distribution vendors including Ubuntu, SUSE, Slackware, Fedora, AlmaLinux, and Debian issued their own advisories and package updates shortly after the upstream release. Community discussion on oss-security mailing lists acknowledged the issue, though CVE-2026-1933 itself received less individual attention compared to the RCE vulnerabilities in the same batch (Ubuntu Advisory, SUSE Advisory).