CVE-2026-59996: OpenSSH scp Path Traversal Vulnerability (v10.4 Fix)

Technical summary

CVE-2026-59996 is a path traversal flaw in scp (secure copy) implemented in OpenSSH prior to version 10.4. The vulnerability occurs during remote-to-remote file transfer operations when path normalization fails to properly validate the destination. An attacker who can influence the source or destination path in an scp command may traverse the directory structure and place files outside the intended target directory. The flaw is rooted in inadequate input sanitization (CWE-23: Relative Path Traversal) and requires user interaction to trigger—specifically, a user must initiate an scp command to or from a malicious remote endpoint or one under attacker control.

Business impact

The primary risk is data integrity compromise and potential system compromise through file placement attacks. An attacker could overwrite critical configuration files, inject malicious scripts into startup directories, or replace legitimate files with trojanized versions if they can intercede in an scp operation. Organizations that frequently use scp for remote data synchronization, backup transfers, or deployment automation face elevated risk. The requirement for user interaction mitigates the risk somewhat, but social engineering or compromised automation scripts could lower that barrier. For most organizations, this is a medium-priority issue requiring attention during the next maintenance cycle but not an emergency.

Affected systems

OpenSSH installations running versions before 10.4 are affected. This includes distributions of OpenBSD OpenSSH and any third-party builds incorporating the vulnerable scp implementation. Both client and server components are in scope if either is running a vulnerable version and the user initiates a remote-to-remote copy. Systems that do not use scp, or that have already upgraded to 10.4 or later, are unaffected.

Exploitability

Exploitation requires user interaction—specifically, a user must run an scp command that involves a remote destination or source controlled or influenced by an attacker. This is not a remotely exploitable worm vector. However, the attack surface is real for organizations where scp is used in automation scripts, deployment pipelines, or where users routinely copy data to or from untrusted or compromised systems. An attacker would need to either control a remote endpoint or perform a man-in-the-middle attack to inject a malicious path. The CVSS score of 4.2 (Medium) reflects the requirement for user action and network proximity, balanced against the integrity impact.

Remediation

Upgrade OpenSSH to version 10.4 or later. Verify the version on affected systems using 'ssh -V' or 'sshd -V'. Organizations should prioritize patching systems where scp is actively used in critical workflows, automated processes, or where users frequently transfer sensitive data. After patching, test remote-to-remote copy operations to ensure compatibility with your deployment environment.

Patch guidance

Consult your operating system vendor or OpenSSH distribution maintainer for patch availability. Most Linux distributions and BSD systems have already backported fixes or released updated packages. Verify the OpenSSH version in your package manager and apply updates through your standard patch management process. OpenSSH 10.4 and later versions contain the fix. If using a third-party or custom build, ensure you are pulling from a source that has incorporated the upstream fix from the OpenSSH project. Test in a non-production environment first to confirm compatibility with your scp-dependent workflows.

Detection guidance

Monitor for unexpected file creation or modification in parent directories relative to intended scp destinations, particularly around configuration, script, or startup directories. Audit scp command invocations in shell histories and authentication logs for suspicious path patterns. Monitor for unusual directory traversal patterns in ssh or sftp logs (e.g., '../' sequences). Organizations using centralized logging or endpoint detection and response (EDR) tools should create detection rules for anomalous file writes following scp commands. Network-based detection is challenging given that scp operates over SSH; focus on host-based monitoring of file system changes and process execution patterns.

Why prioritize this

While the CVSS score is medium and exploitation requires user interaction, file placement attacks can have serious downstream consequences. Prioritize patching systems where scp is embedded in automation, used by privileged users, or operates in environments with elevated trust. Systems in isolated networks or where scp is rarely used can be deprioritized but should still be patched within a standard maintenance window. The vulnerability is not yet in the CISA Known Exploited Vulnerabilities catalog, so active exploitation appears limited, but this should not be a reason to defer patching indefinitely.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects a medium-severity issue with network accessibility (AV:N), high attack complexity (AC:H), no privilege requirement (PR:N), and required user interaction (UI:R). The impact is limited to integrity (I:L) and availability (I:L)—no confidentiality breach. The high attack complexity and user interaction requirement substantially reduce the score. In practice, risk depends on your organization's use of scp; teams heavily dependent on remote-to-remote copy may reasonably elevate this in their internal prioritization.

Frequently asked questions