PT-2026-29805 · Openbsd+4 · Openssh+4

Florian Kohnhäuser · CVE-2026-35385 · Published 2026-04-02 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.3

Description When using the -O option with the legacy scp protocol as root without the -p option, a downloaded file may be installed with setuid or setgid permissions, which may not align with user expectations.

Recommendations Update to version 10.3 or later.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

ALSA-2026:13380

ALSA-2026:13381

ALSA-2026:13383

ALSA-2026:19069

ALSA-2026:19219

CVE-2026-35385

ECHO-13E9-2447-AE62

JLSEC-2026-74

OESA-2026-1963

OPENSUSE-SU-2026:10804-1

OPENSUSE-SU-2026:20757-1

RHSA-2026:12389

RHSA-2026:13380

RHSA-2026:13381

RHSA-2026:13383

RHSA-2026:16059

RHSA-2026:19069

RHSA-2026:19219

RHSA-2026:21298

RHSA-2026:21398

RHSA-2026:22468

RHSA-2026:22564

RHSA-2026:22648

RHSA-2026:25063

SUSE-SU-2026:1876-1

SUSE-SU-2026:2024-1

SUSE-SU-2026:2025-1

SUSE-SU-2026:21627-1

SUSE-SU-2026:21634-1

SUSE-SU-2026:21748-1

SUSE-SU-2026:21798-1

SUSE-SU-2026:21875-1

SUSE-SU-2026:2371-1

SUSE-SU-2026:2375-1

SUSE-SU-2026:2395-1

SUSE-SU-2026:2430-1

SUSE-SU-2026:2515-1

USN-8222-1

USN-8514-1

Affected Products

Ibm Aix

Linuxmint

Openssh

Rocky Linux

Ubuntu

References · 121

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35385.json · Exploit
• https://ubuntu.com/security/notices/USN-8514-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:13381 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2395-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2430-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25063 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35385 · Security Note
• https://access.redhat.com/errata/RHSA-2026:26528 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-13383.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:16059 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2371-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:13383 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30088 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35385 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-35385 · Vendor Advisory