CVE-2026-2340: 
Samba vulnerability analysis and mitigation

CVE-2026-2340 is a vulnerability in Samba's vfs_worm VFS module that allows an authenticated attacker to bypass Write-Once, Read-Many (WORM) file protections by exploiting insufficient validation during rename operations. An authenticated user with write access to a share can overwrite a WORM-protected file by creating a new file and renaming it over the protected target, effectively circumventing the grace-period enforcement. The flaw affects Samba versions starting from 4.1.0 and was publicly disclosed on May 27, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-280 (Improper Handling of Insufficient Permissions or Privileges). The vfs_worm module enforces WORM semantics by blocking write and modification operations on files after a configurable grace period; however, it fails to apply equivalent checks to rename (move) operations targeting protected files. An attacker exploits this by creating a new, unprotected file on the same share and issuing a rename request that overwrites the WORM-protected file — a path the module does not intercept. The attack is network-accessible, requires only low-level authenticated access (valid share credentials), and requires no user interaction (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation results in a high integrity impact: an authenticated attacker can silently overwrite files that are supposed to be immutable under WORM policy, undermining data retention, audit trail integrity, and compliance guarantees (e.g., for regulatory or legal hold scenarios). There is no confidentiality or availability impact — the attacker cannot read protected data or cause a denial of service through this vector alone. However, the ability to tamper with supposedly immutable records could have significant downstream consequences in environments relying on Samba WORM shares for compliance or forensic data preservation (Red Hat CVE).

1. Reconnaissance: Identify a Samba server (version ≥ 4.1.0) with a share configured to use the vfs_worm module. This can be inferred from share enumeration or configuration disclosure.
2. Authenticate to the share: Connect to the target Samba share using valid credentials (e.g., via smbclient or a Windows SMB client) with at least write access.
3. Create a new file: Upload or create a new file on the share within the WORM grace period, or simply create any new file that is not yet WORM-protected.
4. Identify the target: Locate the WORM-protected file (past its grace period) that you wish to overwrite.
5. Execute the rename: Issue a rename (move) operation targeting the WORM-protected file as the destination (e.g., smbclient command rename newfile.txt protected_worm_file.txt). Because vfs_worm does not validate rename destination protection, the operation succeeds and overwrites the protected file.
6. Verify: Confirm the protected file has been replaced with the attacker-controlled content (Red Hat CVE, Red Hat Bugzilla).

• Logs: Samba audit logs (smbd logs with log level = 2 or higher) showing rename operations (rename or NT_RENAME) where the destination file is a WORM-protected path; unexpected modification timestamps on files in WORM-configured shares.
• File System: Files in WORM shares with modification timestamps that post-date the configured grace period; unexpected changes in file size or content hash for files that should be immutable.
• Network: SMB traffic (port 445/TCP) from authenticated users performing rename operations targeting WORM share directories, particularly where the destination file predates the grace period by a significant margin.

Red Hat has addressed this vulnerability for Red Hat Enterprise Linux 10 via security advisory RHSA-2026:22963, which updates Samba to version 4.23.5-109.el10_2 (Red Hat Errata). Upstream Samba patches are tracked in Samba Bugzilla bug 15997 and were included in Samba releases 4.21.3, 4.22.10, and 4.23.8 per the associated security releases (Samba Security Releases). Ubuntu has issued USN-8306-1, and SUSE has released SUSE-SU-2026:2076-1 and SUSE-SU-2026:2108-1 for affected distributions. As a workaround where patching is not immediately possible, administrators can restrict write access to WORM shares to only highly trusted accounts, or temporarily disable the vfs_worm module and enforce immutability through alternative OS-level mechanisms.

The vulnerability was disclosed publicly on May 27, 2026, following an embargo lift noted in the Red Hat Bugzilla entry. Security news outlet SecurityOnline.info covered the broader set of Samba vulnerabilities disclosed at the same time, noting the presence of critical-severity issues in the same release batch (SecurityOnline). The oss-security mailing list also carried a disclosure notice (oss-sec). Community reaction has been measured, given the moderate CVSS score and the requirement for authenticated access with a non-default module configuration.