CVE-2026-2340

May 28, 2026, 3:33 p.m.

6.5
Medium

Description

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

Product(s) Impacted

Vendor Product Versions
Redhat
  • Openshift Container Platform
  • Enterprise Linux
  • 4.0
  • 7.0, 8.0, 9.0, 10.0
Samba
  • Samba
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-280
Improper Handling of Insufficient Permissions or Privileges
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a redhat openshift_container_platform 4.0 / / / / / / /
a samba samba / / / / / / / /
o redhat enterprise_linux 7.0 / / / / / / /
o redhat enterprise_linux 8.0 / / / / / / /
o redhat enterprise_linux 9.0 / / / / / / /
o redhat enterprise_linux 10.0 / / / / / / /

References

https://access.redhat.com/security/cve/CVE-2026-2340
https://bugzilla.redhat.com/show_bug.cgi?id=2447318
https://bugzilla.samba.org/show_bug.cgi?id=15997

Tags

[email protected]
CWE-280
2026-05-27
CVE-2026-2340

CVSS Score

6.5 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: HIGH
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

    View Vector String

Timeline

Published: May 27, 2026, 2:16 p.m.
Last Modified: May 28, 2026, 3:33 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.