Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
yast2-samba-client could run attacker commands during domain join
published 2 months ago
Summary
The yast2-samba-client tool that helps Linux machines join a Windows network can be tricked into executing commands an attacker supplies through a crafted directory entry. This could let the attacker take control of the system. Install the latest update for yast2-samba-client as soon as possible.
What to do
- Update suse yast2-samba-client to version 4.6.2-150600.3.3.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | suse | yast2-samba-client |
< 4.6.2-150600.3.3.1 Fix: upgrade to 4.6.2-150600.3.3.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | suse | yast2-samba-client |
< 4.6.2-150600.3.3.1 Fix: upgrade to 4.6.2-150600.3.3.1
|
Original advisory text
Security update for yast2-samba-client
This update for yast2-samba-client fixes the following issue:
- CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied) during
interactive domain join (bsc#1272776).
- CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied) during
interactive domain join (bsc#1272776).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20263887-1/ Vendor Advisory
- https://bugzilla.suse.com/1272776 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-25706 URL
Timeline
Published31 Aug 2026
Updated10 Sep 2026
First seen10 Sep 2026
Sources
SUSE-SU-2026:3887-1 · OSV
Track software like this
Free during beta