CVE-2026-2340: Samba: vfs_worm does not block directory modification

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-27 · updated 2026-10-15
Weakness: CWE-280

Description

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

Affected products

Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0
Red Hat OpenShift Container Platform 4.18: 4.0
Samba: from 4.1.0

References

https://access.redhat.com/errata/RHSA-2026:22644
https://access.redhat.com/errata/RHSA-2026:22963
https://access.redhat.com/errata/RHSA-2026:25049
https://access.redhat.com/errata/RHSA-2026:25979
https://access.redhat.com/errata/RHSA-2026:28053
https://access.redhat.com/errata/RHSA-2026:28054
https://access.redhat.com/errata/RHSA-2026:28055
https://access.redhat.com/errata/RHSA-2026:28056
https://access.redhat.com/errata/RHSA-2026:28057
https://access.redhat.com/errata/RHSA-2026:29863
https://access.redhat.com/errata/RHSA-2026:56786
https://access.redhat.com/errata/RHSA-2026:56853

Get alerted when CVE-2026-2340 or the next vulnerability affects your stack