PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-1933 Red Hat CVE debrief

A vulnerability in Samba allows authenticated users to bypass read-only share restrictions by manipulating NTFS-style reparse point metadata. The flaw exists because SMB-layer access checks are missing for reparse point operations, enabling users with underlying filesystem write permissions to create or delete reparse points even on shares configured with read only = yes. This could allow attackers to alter SMB-visible file behavior, including converting files into symbolic links or other reparse point types. The vulnerability was published on 2026-05-27 and is currently awaiting analysis in the NVD.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Samba file servers with read-only share configurations, particularly those serving mixed Windows/Unix environments using NTFS-style reparse points. System administrators responsible for Samba security configurations and access control enforcement.

Technical summary

Samba's SMB server fails to enforce access controls on NTFS-style reparse point operations when shares are configured as read-only. While the read only = yes configuration prevents conventional file write operations, the missing SMB-layer checks allow authenticated users with underlying filesystem write access to manipulate reparse point metadata through SMB operations. This enables modification of file behavior visible to SMB clients, including conversion of regular files to symbolic links or other reparse point types without triggering the expected access denial.

Defensive priority

HIGH

Recommended defensive actions

  • Review Samba share configurations for read-only exports and verify underlying filesystem permissions are appropriately restricted
  • Monitor for unexpected reparse point creation or modification activity on Samba shares
  • Apply security updates from Samba or distribution vendors when available
  • Consider implementing additional access controls at the filesystem level to complement SMB-layer restrictions
  • Review symbolic link and reparse point handling policies in Samba configuration

Evidence notes

The vulnerability description indicates missing SMB-layer access checks for reparse point operations on read-only Samba shares. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. The weakness is classified as CWE-284 (Improper Access Control).

Official resources

The vulnerability was disclosed on 2026-05-27 and is currently in Awaiting Analysis status in the National Vulnerability Database.