CVE-2026-2340

Modified Modified - Updated After Analysis

Samba vfs_worm Module File Overwrite Vulnerability

Publication date: 2026-05-27

Last updated on: 2026-07-02

Assigner: Red Hat, Inc.

Description

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-07-02

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-2340

EUVD

EUVD-2026-32312

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0
redhat	openshift_container_platform	4.0
redhat	enterprise_linux	9.0
samba	samba	From 4.1.0 (inc)
redhat	enterprise_linux	10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-280	The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Attack-Flow Graph

Compliance Impact

The provided information does not specify how the vulnerability in Samba's vfs_worm module impacts compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability exists in Samba's vfs_worm module, which is designed to enforce write-once, read-many (WORM) protections by preventing file modifications after a set grace period.

Due to insufficient validation during rename operations, an authenticated user with write access to a share can overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

This flaw allows modification of files that should be immutable under the WORM policy.

Impact Analysis

The vulnerability can lead to unauthorized modification of files that are supposed to be protected by WORM policies, potentially compromising data integrity.

An attacker with write access could overwrite important files, which may result in loss of trust in stored data or security risks related to tampering.

Mitigation Strategies

To mitigate the vulnerability in Samba's vfs_worm module, you should apply the official patches provided by the Samba project as soon as possible.

Additionally, consider disabling the vfs_worm module temporarily if write-once, read-many protections are not critical for your environment until a patch is applied.

Ensure that only trusted authenticated users have write access to Samba shares, as the vulnerability requires authenticated write access to exploit.

Hi! I’m here to help you understand CVE-2026-2340. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70