PT-2026-56288 · Openssh · Openssh

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-59997

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.4

Description The internal-sftp component in sshd only recognizes the first 9 command-line arguments. This limitation may compromise security properties if critical configuration arguments are placed beyond the ninth position and are consequently ignored by the system.

Recommendations Update to OpenSSH version 10.4 or later.

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2026-59997

Affected Products

Openssh

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-59997 · Security Note
• https://twitter.com/CVEnew/status/2074728409276527097 · Twitter Post
• https://openwall.com/lists/oss-security/2026/07/06/5 · Note
• https://twitter.com/infoflowcloud/status/2074730559834661078 · Twitter Post
• https://openssh.org/releasenotes.html#10.4p1 · Note
• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2 · Note