SambaBox CVE-2026-3120: High-Severity OS Command Injection

The National Vulnerability Database has detailed CVE-2026-3120, a high-severity OS Command Injection vulnerability in Profelis Information and Consulting Trade and Industry Limited Company’s SambaBox. Tracked as an Improper Control of Generation of Code (‘Code Injection’) flaw, this vulnerability allows for OS command injection, posing a significant risk to affected systems.

The vulnerability impacts SambaBox versions from 5.1 before 5.3. With a CVSS score of 7.2 (HIGH), the exploit vector is network-based, requires high privileges, and has no user interaction, leading to complete compromise of confidentiality, integrity, and availability. This is a critical flaw that, if exploited, grants attackers deep control over the underlying operating system.

From an attacker’s perspective, a high-privilege OS command injection is a golden ticket. It allows for arbitrary code execution, persistence, data exfiltration, and lateral movement. For defenders, this means a complete bypass of application-level controls, turning a vulnerable SambaBox instance into a launchpad for further network compromise. Patching is non-negotiable.