CVE-2026-25706 yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)
An attacker controlling Active Directory data can execute arbitrary commands as root on machines joining the domain via the SUSE YaST Samba client.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-25706?
CVE-2026-25706 is a high-severity command injection vulnerability in SUSE yast2-samba-client, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root on a machine being joined to that domain. This issue affects yast2-samba-client through 5.0.4.
Weakness: CWE-78
Which versions are affected by CVE-2026-25706?
Linux distribution packages (14)
yast2-samba-client SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 4.4.5-150400.3.6.1 |
yast2-samba-client SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 4.4.5-150400.3.6.1 |
yast2-samba-client SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 4.5.4-150500.3.3.1 |
yast2-samba-client SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 4.5.4-150500.3.3.1 |
yast2-samba-client SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 4.7.2-150700.3.3.1 |
yast2-samba-client SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 3.1.25-3.9.1 |
yast2-samba-client SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 4.4.5-150400.3.6.1 |
yast2-samba-client SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 4.5.4-150500.3.3.1 |
yast2-samba-client SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 4.6.2-150600.3.3.1 |
yast2-samba-client SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.1.25-3.9.1 |
yast2-samba-client SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 4.4.5-150400.3.6.1 |
yast2-samba-client SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 4.5.4-150500.3.3.1 |
yast2-samba-client SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 4.6.2-150600.3.3.1 |
yast2-samba-client openSUSE:Tumbleweed | All versions | 5.0.5-1.1 |
How do I fix CVE-2026-25706?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-25706 being exploited?
There is no known exploitation of CVE-2026-25706 in the wild and no public exploit code.
Sources
Also known as GHSA-rjwh-46cm-g6mv, SUSE-SU-2026:3886-1, SUSE-SU-2026:3887-1, SUSE-SU-2026:3888-1, SUSE-SU-2026:3889-1, SUSE-SU-2026:3890-1 and 1 more.