HCE2-SA-2026-0179 Critical HCE 2.0 Security Fix(es): A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service. (CVE-2026-4408) A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system. (CVE-2026-4480) HCE 2.0 ctdb-4.15.3-4.r28.hce2.x86_64.rpm libsmbclient-4.15.3-4.r28.hce2.x86_64.rpm libsmbclient-devel-4.15.3-4.r28.hce2.x86_64.rpm libwbclient-4.15.3-4.r28.hce2.x86_64.rpm libwbclient-devel-4.15.3-4.r28.hce2.x86_64.rpm python3-samba-4.15.3-4.r28.hce2.x86_64.rpm python3-samba-dc-4.15.3-4.r28.hce2.x86_64.rpm python3-samba-test-4.15.3-4.r28.hce2.x86_64.rpm samba-4.15.3-4.r28.hce2.x86_64.rpm samba-client-4.15.3-4.r28.hce2.x86_64.rpm samba-common-4.15.3-4.r28.hce2.x86_64.rpm samba-common-tools-4.15.3-4.r28.hce2.x86_64.rpm samba-dc-4.15.3-4.r28.hce2.x86_64.rpm samba-dc-bind-dlz-4.15.3-4.r28.hce2.x86_64.rpm samba-dc-provision-4.15.3-4.r28.hce2.x86_64.rpm samba-devel-4.15.3-4.r28.hce2.x86_64.rpm samba-help-4.15.3-4.r28.hce2.x86_64.rpm samba-krb5-printing-4.15.3-4.r28.hce2.x86_64.rpm samba-libs-4.15.3-4.r28.hce2.x86_64.rpm samba-pidl-4.15.3-4.r28.hce2.noarch.rpm samba-test-4.15.3-4.r28.hce2.x86_64.rpm samba-vfs-glusterfs-4.15.3-4.r28.hce2.x86_64.rpm samba-winbind-4.15.3-4.r28.hce2.x86_64.rpm samba-winbind-clients-4.15.3-4.r28.hce2.x86_64.rpm samba-winbind-krb5-locator-4.15.3-4.r28.hce2.x86_64.rpm samba-winbind-modules-4.15.3-4.r28.hce2.x86_64.rpm ctdb-4.15.3-4.r28.hce2.aarch64.rpm libsmbclient-4.15.3-4.r28.hce2.aarch64.rpm libsmbclient-devel-4.15.3-4.r28.hce2.aarch64.rpm libwbclient-4.15.3-4.r28.hce2.aarch64.rpm libwbclient-devel-4.15.3-4.r28.hce2.aarch64.rpm python3-samba-4.15.3-4.r28.hce2.aarch64.rpm python3-samba-dc-4.15.3-4.r28.hce2.aarch64.rpm python3-samba-test-4.15.3-4.r28.hce2.aarch64.rpm samba-4.15.3-4.r28.hce2.aarch64.rpm samba-client-4.15.3-4.r28.hce2.aarch64.rpm samba-common-4.15.3-4.r28.hce2.aarch64.rpm samba-common-tools-4.15.3-4.r28.hce2.aarch64.rpm samba-dc-4.15.3-4.r28.hce2.aarch64.rpm samba-dc-bind-dlz-4.15.3-4.r28.hce2.aarch64.rpm samba-dc-provision-4.15.3-4.r28.hce2.aarch64.rpm samba-devel-4.15.3-4.r28.hce2.aarch64.rpm samba-help-4.15.3-4.r28.hce2.aarch64.rpm samba-krb5-printing-4.15.3-4.r28.hce2.aarch64.rpm samba-libs-4.15.3-4.r28.hce2.aarch64.rpm samba-test-4.15.3-4.r28.hce2.aarch64.rpm samba-winbind-4.15.3-4.r28.hce2.aarch64.rpm samba-winbind-clients-4.15.3-4.r28.hce2.aarch64.rpm samba-winbind-krb5-locator-4.15.3-4.r28.hce2.aarch64.rpm samba-winbind-modules-4.15.3-4.r28.hce2.aarch64.rpm