Medium

Samba missing access check on reparse point operations

IdentifiersCVE-2026-1933CWE-284· Improper Access Control

CVE-2026-1933 is a high-severity access control flaw in Samba affecting versions since 4.21. Samba fails to enforce SMB-layer write restrictions when handling NTFS-style reparse point metadata on shares configured with "read only = yes" and on file handles opened read-only. Due to missing access checks, an authenticated user who has underlying filesystem write permission to the exported files can still set or delete the reparse point metadata via SMB operations. In Samba, this metadata is stored in the "user.SmbReparse" extended attribute, with the FILE_ATTRIBUTE_REPARSE_POINT bit tracked in the "user.DosAttrib" xattr. As a result, a user can modify SMB-visible file behavior on a nominally read-only share, including converting existing files into symbolic links or other reparse point types as seen by Windows and Linux clients.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated user to bypass Samba's read-only share enforcement for reparse point operations and alter how files are presented over SMB. This can be used to convert existing files into symlinks or other reparse point types, changing client-visible file semantics despite the export being configured read-only. The documented impact is primarily integrity and availability: attackers can modify reparse point metadata and potentially disrupt access to large portions of a filesystem, including making files effectively unavailable to normal users by turning them into symlinks or other reparse points. The published CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H with a score of 7.1.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, ensure that users who can access shares configured with "read only = yes" do not also have underlying filesystem-level write permission to the exported files. This workaround reduces exploitability because the vulnerable operations still require the ability to write the relevant extended attributes at the filesystem layer. Monitoring for unexpected changes to "user.SmbReparse" and "user.DosAttrib" on read-only exports may also help detect abuse, but the primary mitigation is removing filesystem write access or patching.

Remediation

Patch, then assume compromise.

Upgrade Samba to a fixed release. The Samba project states the issue is fixed in 4.22.10, 4.23.8, and 4.24.3, and published patches on its security page. Administrators should upgrade to one of the fixed versions or apply the vendor patch as soon as possible. If files were already modified, remediation includes removing the "user.SmbReparse" extended attribute and clearing the FILE_ATTRIBUTE_REPARSE_POINT bit in the "user.DosAttrib" xattr on affected files.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Red HatEnterprise Linuxoperating_system

Red HatOpenshift Container Platformapplication

SambaSambaapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

sambaNews

Jan 1, 2026

Samba - Security Announcement Archive

A Samba vulnerability caused by missing access checks on reparse point operations, allowing users with filesystem-level write permissions to set or delete reparse point metadata via SMB even on shares marked read-only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5