CVE-2026-15370 Red Hat CVE debrief

Who should care

Defenders responsible for libssh-based SFTP servers, particularly those using Red Hat Enterprise Linux 10, should assess exposure and prioritize updates to mitigate potential risks. Additionally, security teams and vulnerability management teams should review the vulnerability and its potential impact on their organizations. Operators and administrators of affected systems should also be aware of the vulnerability and take necessary actions to protect them

Why it matters

CVE-2026-15370 is a medium-severity vulnerability in libssh's SFTP server directory listing functionality, potentially leading to server crashes or code execution. Defenders should prioritize verifying and updating libssh, restricting SFTP access, and monitoring logs.

• Potential server crashes due to buffer overflows
• Possible code execution on the server
• Need for verification of libssh versions and updates
• Importance of monitoring SFTP server logs for suspicious activity

Technical summary

The libssh library is vulnerable to a stack buffer overflow in its SFTP server directory listing functionality. When a client requests a directory listing with sufficiently long filenames, it can cause a buffer overflow, potentially leading to a server crash or code execution. The vulnerability affects libssh and can be exploited by clients requesting directory listings with long filenames. Defenders should prioritize verifying and updating libssh to mitigate potential stack buffer overflows in SFTP server directory listings.

Defensive priority

Defenders should prioritize verifying and updating libssh to mitigate potential stack buffer overflows in SFTP server directory listings.

Recommended defensive actions

• Verify and update libssh to the latest version
• Review and restrict SFTP server access to trusted users
• Monitor SFTP server logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected products. The vulnerability was publicly disclosed on 2026-07-21 and has a CVSS score of 6.7. The NVD entry is currently Analyzed. Additional information can be found in vendor advisories from Red Hat. The evidence is limited to publicly available sources and may not be comprehensive.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.