medium CVSS 4.8 EPSS 0.18%

CVE-2026-59998·OpenSSH vulnerability

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.

Severity
medium
Software
OpenSSH
Fixed in
10.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.18% — higher than 7% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 10.4

Fixed in: 10.4

How to fix this CVE

Update OpenSSH to version 10.4p1-1 or later to address a configuration validation issue where GSSAPIStrictAcceptorCheck may not function as intended in Windows Active Directory environments. This vulnerability could allow unintended authentication behavior in domain-joined SSH servers. Apply the patch immediately to all affected OpenSSH instances, especially those integrated with Active Directory or LDAP-based authentication systems.

sudo dnf update openssh-server openssh-clients

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed OpenSSH version: ssh -V or sshd -v
  2. Verify GSSAPIStrictAcceptorCheck configuration: grep -n 'GSSAPIStrictAcceptorCheck' /etc/ssh/sshd_config (if not set, defaults may be affected)
  3. Review authentication logs for unexpected GSSAPI authentication successes: grep 'GSSAPI' /var/log/auth.log or /var/log/secure, especially for entries marked as 'Accepted'
  4. Confirm patch installation: dpkg -l | grep openssh-server (Debian/Ubuntu) or rpm -qa | grep openssh-server (RHEL/CentOS) and verify version is 10.4p1-1 or later

FAQ

What is CVE-2026-59998?

CVE-2026-59998 is a vulnerability in OpenSSH where the GSSAPIStrictAcceptorCheck security setting fails to enforce its intended validation rules when sshd operates in a Windows Active Directory environment, potentially allowing uncontrolled GSSAPI authentication acceptance.

Is CVE-2026-59998 being actively exploited?

No, there are currently no public reports of active exploitation or publicly available exploits for CVE-2026-59998, though organizations using AD-integrated SSH authentication should prioritize patching.

What versions of OpenSSH are affected by CVE-2026-59998?

All OpenSSH versions prior to 10.4p1-1 are affected. The vulnerability is resolved in OpenSSH 10.4p1-1 and all subsequent releases.

How do I check if my server is vulnerable to CVE-2026-59998?

Run 'sshd -v' and check if the version is earlier than 10.4p1-1. Additionally, run 'grep GSSAPIStrictAcceptorCheck /etc/ssh/sshd_config' to see your current GSSAPI strictness setting.

Does Defensia detect CVE-2026-59998?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2026-59998 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-59998. Free for 1 server.

Get started free