SSamba

Products

Exploited and recent CVEs

• CVE-2017-7494 Critical 9.8 Exploited Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then 99.4%
• CVE-2026-109411 High 8.1 Samba: access control bypass via vfs_ceph_rgw case-insensitive open 0.6%
• CVE-2026-41035 High 7.4 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, m 0.4%
• CVE-2024-58250 Critical 9.3 The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges. 0.2%
• CVE-2021-44142 High 8.8 The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions 73.6%
• CVE-2020-14342 Medium 4.4 It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special p 0.7%