CVE-2026-59997
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability in the internal-sftp server in sshd in OpenSSH before version 10.4 causes only the first 9 command-line arguments to be recognized. This can be significant if a later argument would have ensured the intended security properties of an SFTP connection.
Risk Assessment
The organization may unknowingly configure SFTP connections without critical security options, potentially leading to unauthorized access or weakened data transmission protection.
Recommendation
Immediately update OpenSSH to version 10.4 or later, which includes a fix for this limitation.
Original NVD description (English source)
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.