CVE-2017-7494: Samba writable share library upload leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, confirmed KEV listing with known ransomware use, near-maximum EPSS, and public exploit code make this an urgent patch-or-isolate case for any exposed unpatched Samba host.

What it is

Samba versions from 3.5.0 up to (but not including) 4.6.4, 4.5.10 and 4.4.14 allow a malicious client to upload a shared library to a writable share and then cause the server to load and execute it. This is a network-reachable code injection flaw (CWE-94) that yields full server compromise without credentials or user interaction. It is a long-known, widely exploited issue that remains relevant wherever unpatched Samba file servers are exposed.

Impact

An attacker gains remote code execution with the privileges of the Samba service, typically root, allowing full control of the file server and any data or credentials it holds. CISA KEV records known ransomware campaign use, so the practical outcome includes ransomware deployment and lateral movement.

Attack surface

Reached over the network via SMB (CVSS vector AV:N/AC:L/PR:N/UI:N), so no authentication and no user interaction are required. The only precondition stated is that the target exposes a writable share the client can upload to.

Exploitation

Exploitation is confirmed and mature: CISA KEV lists it with a 2023-04-20 remediation due date and known ransomware use, EPSS 30-day probability is 0.99448 (99.9th percentile), and public exploit code exists in Exploit-DB (42060, 42084).

What to do

• Patch Samba to 4.6.4, 4.5.10, 4.4.14 or later, or apply the vendor/distribution updates referenced in the Samba advisory and Red Hat, Debian and Gentoo errata.
• Disable or restrict writable shares, especially those allowing anonymous or guest write access, and remove write permission where it is not operationally required.
• Block SMB (TCP 445/139) from untrusted networks and segment file servers so only required clients can reach them.
• Enable the Samba mitigation that prevents loading libraries from writable shares (e.g. the 'nt pipe support = no' workaround documented by the vendor) if patching cannot be done immediately.
• Inventory internet- or broadly reachable Samba hosts and prioritize those still running versions below the fixed releases.

Detection

• Monitor SMB write activity for uploads of shared library files (.so) into writable shares, particularly to paths later referenced by the server.
• Alert on Samba processes loading libraries from share directories or other unexpected paths (e.g. via auditd, eBPF or process-to-file telemetry).
• Hunt for SMB connections from unusual or external source addresses followed by new files in shares and subsequent service process activity.
• Correlate Samba server logs and file integrity monitoring for new .so files in shares with immediate process execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.