CVE-2026-25706: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in SUSE yast2-samba-client

This vulnerability arises from improper neutralization of special elements used in OS commands within yast2-samba-client. An attacker with control over the Active Directory directory tree content can exploit this flaw to execute arbitrary commands with root privileges on the target machine during the domain join process. The issue affects all versions of yast2-samba-client up to and including 5.0.4. No official patch or remediation level has been published by SUSE as of the provided data.

Successful exploitation results in arbitrary command execution as root on the affected system, leading to full system compromise. This can severely impact confidentiality, integrity, and availability of the affected machine. The vulnerability requires network access and user interaction (UI:R) but no privileges or authentication (PR:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the ability to control or create objects in the Active Directory directory tree to trusted administrators only. Monitor domain join operations carefully and consider isolating systems during domain joins from potentially untrusted domain controllers.