CVE-2026-59996·OpenSSH vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.25% — higher than 15% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Update OpenSSH to version 1:10.4p1-1 or later to resolve a directory traversal issue in the scp utility that could allow files to be written outside the intended destination during remote-to-remote copy operations. This vulnerability is particularly concerning in automated backup and file transfer scenarios where scp is used with untrusted or partially-controlled paths. Apply the security update across all systems running affected OpenSSH versions.

sudo dnf update openssh-server openssh-clients

How to check if you are affected

1. Step 1: Run `ssh -V` and `scp -v /dev/null localhost:/tmp 2>&1 | grep -i openssh` to confirm the installed OpenSSH version
2. Step 2: Cross-reference the version against the affected range (all versions before 1:10.4p1-1) using `dpkg -l | grep openssh-server` on Debian/Ubuntu or `rpm -qa | grep openssh-server` on RHEL/CentOS
3. Step 3: Search system logs for scp activity with suspicious parent directory references using `grep -r 'scp' /var/log/auth.log* /var/log/secure* 2>/dev/null | grep -E '\.\./|parent'`
4. Step 4: After updating, verify the fix using `ssh -V` and confirm the version is 1:10.4p1-1 or later, then restart the SSH service with `sudo systemctl restart sshd`

FAQ

Related OpenSSH CVEs

References

• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1
• https://www.openwall.com/lists/oss-security/2026/07/06/5