⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2023-04-20.
CVE-2017-7494 — Code Injection in Samba
Severity
9.8CRITICALNVD
EPSS
94.2%
top 0.07%
CISA KEV
KEVRansomware
Added 2023-03-30
Due 2023-04-20
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedMay 30
KEV addedMar 30
KEV dueApr 20
Latest updateOct 28
CISA Required Action: Apply updates per vendor instructions.
Description
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages4 packages
Also affects: Debian Linux 8.0
Patches
🔴Vulnerability Details
3💥Exploits & PoCs
3🔍Detection Rules
3Suricata▶
ET EXPLOIT Samba Arbitrary Module Loading Vulnerability M2 (NT Create AndX .so) (CVE-2017-7494)↗2017-06-16
Suricata▶
ET EXPLOIT Samba Arbitrary Module Loading Vulnerability (.so file write to share) (CVE-2017-7494)↗2017-05-25
Suricata▶
ET EXPLOIT Samba Arbitrary Module Loading Vulnerability (NT Create AndX .so) (CVE-2017-7494)↗2017-05-25
📋Vendor Advisories
8🕵️Threat Intelligence
13📄Research Papers
8arXiv▶
Cybersecurity AI Benchmark (CAIBench): A Meta-Benchmark for Evaluating Cybersecurity AI Agents↗2025-10-28
arXiv▶
xOffense: An AI-driven autonomous penetration testing framework with offensive knowledge-enhanced LLMs and multi agent systems↗2025-09-16
arXiv▶
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware↗2022-12-29