CVE-2026-59998 Security feature bypass in OpenSSH

Medium 4.8 Published 8 Jul 2026 Updated 8 Jul 2026

OpenSSH server may bypass GSSAPI strict acceptance checks in Windows Active Directory environments, potentially weakening authentication security.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-59998?

CVE-2026-59998 is a medium-severity vulnerability in OpenSSH, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.

Weakness: CWE-573

Which versions are affected by CVE-2026-59998?

It affects 1 product.

Products include OpenSSH.

How do I fix CVE-2026-59998?

Upgrade to a fixed version.

Is CVE-2026-59998 being exploited?

There is no known exploitation of CVE-2026-59998 in the wild and no public exploit code.

All OpenSSH vulnerabilities

Sources

Also known as ALPINE-CVE-2026-59998, AZL-92184, BELL-CVE-2026-59998, CLSA-2026-1784280067, CLSA-2026-1784297006, DEBIAN-CVE-2026-59998 and 7 more.