CVE-2026-59998

MediumCVSS 4.8

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

In OpenSSH before version 10.4, an undocumented security-relevant behavior was found: the GSSAPIStrictAcceptorCheck parameter has no value when the server is in a Windows Active Directory environment.

Risk Assessment

This may lead to incorrect validation of GSSAPI client identities, increasing the risk of unauthorized access to the system.

Recommendation

It is recommended to immediately update OpenSSH to version 10.4 or later, which fixes this vulnerability.

Original NVD description (English source)

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.