CVE-2026-59995 OpenBSD CVE debrief

Who should care

Administrators and users of OpenSSH sftp versions before 10.4 should be aware of this vulnerability and take necessary actions to secure their systems. This includes updating OpenSSH to version 10.4 or later, restricting access to sftp services, and monitoring sftp logs for suspicious activity.

Technical summary

The vulnerability is caused by the lack of proper constraints on the location of downloaded files when using 'sftp server:/path .' with an attacker-controlled server. This could potentially lead to unauthorized file downloads and may impact the security of systems using OpenSSH sftp. The vulnerability has a CVSS score of 4.2 and a severity of MEDIUM. Affected products include OpenSSH versions before 10.4. To mitigate this vulnerability, it is recommended to update OpenSSH to version 10.4 or later. Additionally, restricting access to sftp services and monitoring sftp logs for suspicious activity can help prevent exploitation. It is also essential to review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium priority should be given to updating OpenSSH to version 10.4 or later to mitigate this vulnerability.

Recommended defensive actions

• Update OpenSSH to version 10.4 or later
• Restrict access to sftp services
• Monitor sftp logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-08T01:16:28.390Z and has not been modified since then. The NVD entry is currently in the 'Received' status. This information is based on the supplied source corpus and may not reflect the current status of the vulnerability. Further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.