CVE-2026-3012: do not trust CA certificates fetched over HTTP in the
certificate auto-enrollment GP extension; use only LDAP-derived
certificates and skip CAs with no cACertificate attribute
CVE-2026-4408: escape shell metacharacters in the client-controlled
username before substituting it into the "check password script" via
%u, preventing remote command injection