November 5, 2026
- Samba command injection via print job name (CVE-2026-4480, CVSS 9.8) — a client-controlled job name reaches the shell unescaped where
%Jis used in a custom print command, giving unauthenticated RCE. Fixed in 4.22.10 / 4.23.8 / 4.24.3; public PoC. · Vulnerabilities & Public Exploits