@arnaudrigole I’m guessing your CIFS/SAMBA shares are mounted as network drives on other computers, yes?
The NFS shares should only be mounted on computers that are going get their image captured or where an image will be deployed and only for the duration of those actions.
I’ve yet to see a virus sniff out possible NFS connections and then be able to somehow use the correct credentials to then infect the shares, but I guess I could be wrong 