CVE-2026-59997 Security feature bypass in OpenSSH
OpenSSH internal-sftp ignores command-line arguments beyond the ninth, potentially bypassing intended security restrictions on SFTP connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59997?
CVE-2026-59997 is a medium-severity vulnerability in OpenSSH, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.
Weakness: CWE-1284
Which versions are affected by CVE-2026-59997?
It affects 1 product.
Products include OpenSSH.
How do I fix CVE-2026-59997?
Upgrade to a fixed version.
Is CVE-2026-59997 being exploited?
There is no known exploitation of CVE-2026-59997 in the wild and no public exploit code.
Other vulnerabilities in OpenSSH
Sources
Also known as ALPINE-CVE-2026-59997, AZL-92036, BELL-CVE-2026-59997, DEBIAN-CVE-2026-59997, ECHO-94a5-77ee-11fa, GHSA-56r6-6mmg-25j5 and 5 more.