Samba 4.23 End of Life: Security Fixes Until March 2027
Samba 4.23 is in security fixes only mode and is discontinued (EOL) in March 2027. Those are the status and the date for 4.23 on Samba's own Release Planning page. Samba 4.23.0 was released on September 12, 2025, and the series moved to security fixes only in September 2026, when 4.25 became the current stable series. Samba plans each series for about 18 months: six months fully supported, six months in maintenance mode, six months in security fixes only mode. Once a series is discontinued, Samba's wording is that there won't be any other versions of it.
The Samba series that are maintained now
| Series | Status today | Released | Security fixes only from | Discontinued (EOL) |
|---|---|---|---|---|
| 4.25 | Current stable release series | September 24, 2026 | September 2027 | March 2028 |
| 4.24 | Maintenance mode | March 18, 2026 | March 2027 | September 2027 |
| 4.23 | Security fixes only | September 12, 2025 | September 2026 | March 2027 |
Samba 4.22 was discontinued in September 2026, and every older series before it. Samba 4.26 is listed as the next upcoming release series. Every series is on the Samba page.
What 4.23 still gets before it is discontinued
Samba defines the four modes on the planning page, and the difference between them is what a 4.23 server can still expect:
- Current stable (4.25): available bug fixes go into regular bug fix releases, usually every six weeks.
- Maintenance mode (4.24): regular bug fix releases to address major issues and security issues, with fewer patches backported than to the current series.
- Security fixes only (4.23): only security issues will be addressed in the series.
- Discontinued (4.22 and older): no further versions of the series.
In practice, a 4.23 server keeps getting security releases until March 2027, prepared through the Samba Security Process alongside the same fixes for 4.24 and 4.25. The 2026 releases show what that looks like: 4.23.8 and 4.23.10 were security releases, shipped together with security releases for 4.24, and the first of them fixed two flaws Samba describes as unauthenticated remote code execution, in the DCE/RPC SAMR server and in the printing subsystem. A bug that is not a security issue, such as a crash or a regression in a module, is now fixed in the newer series, not in 4.23.
Security exposure and the KEV entry
Samba appears once in CISA's Known Exploited Vulnerabilities catalog: CVE-2017-7494, remote code execution from a writable share, which CISA marks as known to be used in ransomware campaigns. Samba's security announcement lists the affected versions at the time as all versions from 3.5.0 onwards and names 4.6.4, 4.5.10 and 4.4.14 as the security releases that fixed it. That was years before 4.23 existed, so the KEV entry is not a 4.23 problem. Neither of the two unauthenticated remote code execution flaws fixed in 4.23.8 is in the catalog.
The exposure that matters for 4.23 is the date. Samba's 2026 security releases shipped for 4.23 and 4.24 on the same day. A comparable flaw found after March 2027 gets fixed in 4.24, 4.25 and 4.26, and not in 4.23. A Samba Active Directory domain controller or a file server reachable from user networks is exactly the system where that gap matters. The live risk score for 4.23 is 38.
Moving to 4.24 or 4.25
4.24 buys six months. It is in maintenance mode now, moves to security fixes only in March 2027, the same month 4.23 is discontinued, and is discontinued itself in September 2027.
4.25 buys a year. It is the current stable series, released on September 24, 2026, gets security fixes only from September 2027 and is discontinued in March 2028. For anyone planning one upgrade instead of two, it is the target. A move from 4.23 crosses two series, so read the release notes for both 4.24.0 and 4.25.0. One 4.25.0 change to plan for on Active Directory domain controllers: the default for kdc default domain supported enctypes now means AES only (aes128 and aes256) when the domain functional level is 2008 or higher, which matters for any client or account that still relies on RC4.
Paid support and distribution packages
The schedule above is the Samba Team's own. If your Samba comes from a Linux distribution's packages, the distribution's support policy for that package applies instead, and it can run longer or shorter than the upstream series. Samba's website keeps a directory of commercial support providers by country. Samba does not publish an extended-support date for 4.23, so if you need fixes for 4.23 after March 2027, ask a provider in writing whether it covers that series and for how long.
What to do
- Find every Samba 4.23 instance: domain controllers, file servers, NAS appliances and container images pinned to a 4.23 build. Run
smbd --versionorsamba --versionon each. - Keep 4.23 on the newest security release until you move. Security fixes only mode still ships fixes, but only if you install them.
- Plan the move to 4.25 before March 2027. Read the 4.24.0 and 4.25.0 release notes, check the Kerberos encryption type change on domain controllers, and test on one server first.
- Back up first: on an AD domain controller, take a backup of the domain database before the upgrade and check you can restore it.
Frequently Asked Questions
When is Samba 4.23 end of life?
Samba's Release Planning page lists Samba 4.23 as discontinued (EOL) in March 2027. Samba publishes that date as a month, and the page says future dates are forecasts at the discretion of the release manager. After that, Samba ships no further versions of the 4.23 series.
Is Samba 4.23 still getting bug fixes?
Only security fixes. Samba 4.23 entered security fixes only mode in September 2026, and Samba's definition of that mode is that only security issues will be addressed in the series. Ordinary bug fixes go to the newer series.
What should I upgrade Samba 4.23 to?
Samba 4.25, the current stable release series, which the Release Planning page schedules to be discontinued in March 2028. Samba 4.24 is already in maintenance mode and is discontinued in September 2027, only six months after 4.23.
Is Samba on the CISA Known Exploited Vulnerabilities list?
Yes, with one entry: CVE-2017-7494, a remote code execution flaw through a writable share, which CISA marks as known to be used in ransomware campaigns. Samba fixed it in 4.6.4, 4.5.10 and 4.4.14, long before 4.23 existed, so it does not affect 4.23.
Related
- Samba — every series and its dates
- Samba 4.24 — the maintenance-mode series
- Samba 4.25 — the current stable series
- Windows Server — version dates for the Windows side of a mixed domain