CVE-2026-35385 Privilege escalation in OpenSSH

High 7.5 Published 2 Apr 2026 Updated 1 Sep 2026

Attackers can gain elevated privileges if root downloads files via legacy scp without preserving permissions, allowing setuid/setgid bits to be set.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-35385?

CVE-2026-35385 is a high-severity vulnerability in OpenSSH, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

Weakness: CWE-281

Which versions are affected by CVE-2026-35385?

It affects 1 product.

Linux distribution packages (4)

`openssh` Red Hat:rhel_els:6	All versions	`0:5.3p1-125.el6_10.1`
`openssh-clients` Red Hat:rhel_els:6	All versions	`0:5.3p1-125.el6_10.1`
`openssh` Red Hat:rhel_els:7	All versions	`0:7.4p1-23.el7_9.2`
`openssh-clients` Red Hat:rhel_els:7	All versions	`0:7.4p1-23.el7_9.2`

Products include OpenSSH.

How do I fix CVE-2026-35385?

Upgrade to a fixed version.

Is CVE-2026-35385 being exploited?

There is no known exploitation of CVE-2026-35385 in the wild and no public exploit code.

All OpenSSH vulnerabilities

Sources

Also known as ALPINE-CVE-2026-35385, AZL-81797, BELL-CVE-2026-35385, CLSA-2026-1777479123, CLSA-2026-1777542837, CLSA-2026-1777546896 and 20 more.