CVE-2026-59996

MediumCVSS 4.2

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A vulnerability in the scp tool in OpenSSH before version 10.4 may place a file in the parent directory of the intended directory when copying between two remote destinations.

Risk Assessment

The risk involves potential overwriting or placement of files in unexpected locations, which could lead to data integrity compromise or privilege escalation.

Recommendation

It is recommended to immediately update OpenSSH to version 10.4 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.