CVE-2026-14476 is a path traversal vulnerability in the SSSD AD GPO provider component of Red Hat Enterprise Linux 10. Specifically, the ad_gpo_extract_smb_components() function does not properly sanitize '..' sequences in the gPCFileSysPath LDAP attribute. This flaw allows an attacker who has AD GPO management access to write arbitrary files outside the GPO cache directory with root privileges. When SELinux is enforcing under default RHEL configurations, this vulnerability can be exploited to inject malicious Kerberos configuration, potentially leading to authentication bypass. The CVSS v3.1 score is 8.0, indicating high severity. The vendor advisory is published but does not explicitly state patch or remediation status.

An attacker with Active Directory Group Policy Object management access can exploit this vulnerability to write files as root outside the intended directory. This can lead to injection of malicious Kerberos configuration, resulting in authentication bypass on systems with default SELinux enforcing settings. The impact includes complete compromise of authentication mechanisms and potential system takeover.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-14476 for current remediation guidance. Until an official fix is available, restrict AD GPO management access to trusted administrators only and monitor for suspicious modifications to GPO configurations. No vendor advisory states that no action is required or that the issue is already mitigated.