Samba
Samba implements SMB/CIFS file sharing and Active Directory domain controller services on Unix-like hosts. File servers and AD DCs that serve Windows clients expose a large protocol surface. NVD tracks the product as cpe:2.3:a:samba:samba. High-impact history includes writable-share library loading (EternalRed), Apple vfs_fruit heap corruption, Kerberos ticket handling on AD DCs, and pipe-name path traversal to Unix sockets.
Querying Samba
samba4.14.0, 4.21.9, 4.15.5curl "https://api.attestd.io/v1/check?product=samba&version=4.14.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Samba 4.14.0 is affected by CVE-2021-44142 (out-of-bounds heap write in vfs_fruit). The response shows risk_state: "critical" with active exploitation signals when KEV-linked Samba CVEs apply to the queried line.
{
"product": "samba",
"version": "4.14.0",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": "4.21.9",
"confidence": 0.5,
"cve_ids": [
"CVE-2016-2124",
"CVE-2018-14628",
"CVE-2020-17049",
"CVE-2020-25717",
"CVE-2020-25718",
"CVE-2020-25719",
"CVE-2020-25721",
"CVE-2020-25722",
"CVE-2020-27840",
"CVE-2021-20251",
"CVE-2021-20254",
"CVE-2021-20277",
"CVE-2021-20316",
"CVE-2021-23192",
"CVE-2021-3670",
"CVE-2021-3671",
"CVE-2021-3738",
"CVE-2021-44141",
"CVE-2021-44142",
"CVE-2022-0336",
"CVE-2022-1615",
"CVE-2022-2031",
"CVE-2022-32742",
"CVE-2022-32743",
"CVE-2022-32744",
"CVE-2022-32745",
"CVE-2022-32746",
"CVE-2022-3437",
"CVE-2022-37966",
"CVE-2022-37967",
"CVE-2022-38023",
"CVE-2022-42898",
"CVE-2022-45141",
"CVE-2023-0614",
"CVE-2023-0922",
"CVE-2023-34966",
"CVE-2023-34967",
"CVE-2023-34968",
"CVE-2023-3961",
"CVE-2023-4091",
"CVE-2023-4154",
"CVE-2023-42669",
"CVE-2023-42670",
"CVE-2023-5568",
"CVE-2025-10230",
"CVE-2026-4408"
],
"cves": null,
"max_epss": 0.73539,
"last_updated": "2026-08-03T04:35:45.282419Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}Samba 4.21.9 is past the CVE-2021-44142, CVE-2022-45141, and CVE-2023-3961 fix lines on the 4.13 through 4.19 branches.
curl "https://api.attestd.io/v1/check?product=samba&version=4.21.9" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
Samba's critical CVEs track SMB share write paths, VFS modules used for macOS clients, and AD domain controller Kerberos handling. EternalRed (CVE-2017-7494) remains the canonical writable-share RCE. Later issues show that AD DC privilege boundaries and pipe naming still produce CVSS 9.x outcomes when attackers reach smbd.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2017-7494KEV | Writable-share library upload executes as root on the Samba server (EternalRed). | ≥3.5.0 before 4.6.4/4.5.10/4.4.14 | 9.8 |
CVE-2021-44142 | Out-of-bounds heap write in vfs_fruit enables RCE as the smbd user. | <4.13.17 / <4.14.12 / <4.15.5 | 8.8 |
CVE-2022-45141 | RC4-HMAC Kerberos ticket handling enables privilege escalation on AD DCs. | <4.15.13 / <4.16.8 | 9.8 |
CVE-2023-3961 | Path traversal on client pipe names reaches Unix sockets outside the private dir. | <4.17.12 / <4.18.8 / <4.19.1 | 9.8 |
KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.
Samba CPE namespace
NVD uses one Samba product identifier across file-server and AD DC CVEs. Affected ranges are usually published per maintenance branch (4.13, 4.14, 4.15, and so on).
cpe:2.3:a:samba:sambaSMB file server and AD DC releasesQuery product=samba with the dotted Samba version your host reports. Attestd maps that version onto the per-branch NVD ranges and returns the aggregated risk state.