CVE-2026-25706 — yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)
Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rog…
Published: 2026-09-01 · CVSS: 7.5 · CVSS 4.0
Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root on a machine being joined to that domain. This issue affects yast2-samba-client through 5.0.4.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7