CVE-2026-25706

CVE-2026-25706 is an OS command injection flaw (CWE-78) in yast2-samba-client, the YaST module used to join SUSE and openSUSE machines to Active Directory domains, in all versions through 5.0.4. It is triggered when an adversary who controls the content of the AD directory tree — either a rogue domain controller or a directory user delegated the right to create objects — supplies hostile directory data that the join process fails to properly neutralize. A successful attack yields execution of arbitrary commands with root privileges on the SUSE/openSUSE machine being joined to the domain. Exposure requires an administrator to actually run the domain join (per the CVSS 4.0 vector, user interaction is active and attack complexity is rated present), so an arbitrary internet attacker cannot trigger it remotely against a random target; the realistic victims are hosts joined to a domain whose controllers or delegated users have been compromised. No exploitation is confirmed: the flaw is absent from CISA KEV, has no known public proof-of-concept, and EPSS estimates a 0.4% probability of exploitation in the next 30 days.

What to do: Update yast2-samba-client as soon as SUSE/openSUSE publishes a release beyond 5.0.4 in their advisory channels. Until patched, only join hosts to AD forests you fully control and trust, verify that all domain controllers are legitimate, and restrict delegated directory users' ability to create objects. Audit recently joined hosts and treat any domain join performed against a compromised AD tree as potential root compromise of the joined machine.