CVE-2026-59997: OpenSSH SFTP Argument Parsing Vulnerability – Patch Guidance

Technical summary

CVE-2026-59997 affects the internal-sftp component of sshd in OpenSSH versions prior to 10.4. The vulnerability stems from insufficient argument handling in the SFTP subsystem initialization code. When sshd invokes internal-sftp, it passes command-line arguments to configure the SFTP environment. The parser only recognizes and processes the first 9 arguments; any arguments in positions 10 and beyond are discarded. This is significant because OpenSSH administrators may rely on later arguments (such as those controlling chroot jails, read-only enforcement, or logging parameters) to enforce security policies. An attacker able to influence the SSH connection or configuration stack could potentially cause the SFTP server to bypass intended security constraints.

Business impact

Organizations relying on SFTP as a file transfer mechanism may unwittingly deploy less restrictive access controls than configured. If administrators expect certain security parameters—such as directory restrictions or operation limitations—to be enforced on SFTP connections, those settings may fail silently when specified as 10th or higher arguments. This could allow users to access files or perform operations outside their intended scope, creating data exposure or integrity risks. The impact is particularly acute in environments where SFTP is used for privileged file transfers, backup operations, or cross-organizational data exchange.

Affected systems

OpenSSH versions before 10.4 are affected. The vulnerability is specific to systems running sshd with internal-sftp enabled. Any deployment of vulnerable OpenSSH—whether on Linux, BSD, or other Unix-like systems—where SFTP is active and command-line arguments are used to configure security boundaries is at risk. Organizations should check their OpenSSH version and review whether their SSH configurations rely on arguments beyond the 9th position for SFTP security enforcement.

Exploitability

Exploitation requires network access to the SSH service (CVSS AV:N) and human interaction or indirect influence over SSH configuration (CVSS UI:R). The attack complexity is high (CVSS AC:H), meaning an attacker would need to engineer a specific scenario where security-critical arguments are placed in positions 10 or higher and then trigger an SFTP connection. This is not a trivial remote code execution; rather, it is a logic flaw that manifests only when certain conditions align. An internal attacker with configuration privileges, or an attacker who can influence how SSH keys or configurations are deployed, would have a more straightforward path to exploitation than an external threat actor.

Remediation

Upgrade OpenSSH to version 10.4 or later. Before upgrading, audit your current SSH configurations to identify any SFTP command-line arguments and verify that none of your security-critical parameters (such as chroot paths, read-only flags, or subsystem-specific options) are specified as the 10th argument or beyond. Rearrange arguments if necessary to keep essential security settings within the first 9 positions as a temporary mitigation.

Patch guidance

Patch availability: OpenSSH 10.4 and later contain the fix. Verify the exact version available for your distribution by checking vendor repositories or the OpenSSH website. Most Linux distributions (Red Hat, Debian, Ubuntu, SUSE, etc.) should release updated packages; consult your vendor's security advisory. BSD systems (OpenBSD, FreeBSD, NetBSD) should reference their respective security updates. Test patched versions in a non-production environment first to ensure compatibility with your SFTP workflows and any custom configurations before rolling out enterprise-wide.

Detection guidance

Monitor SSH logs for unusual SFTP subsystem invocations, particularly those with 10 or more command-line arguments. If you have custom monitoring, flag any sshd process arguments that place security-critical parameters beyond the 9th position. Review your active SSH server configurations (typically in /etc/ssh/sshd_config and related includes) to identify SFTP subsystem directives and count their arguments. Compare your OpenSSH version against known vulnerable versions. Additionally, test your SFTP configuration by attempting connections and verifying that expected security constraints (e.g., chroot jails, permission restrictions) are actually enforced.

Why prioritize this

This vulnerability merits prompt but measured attention. The CVSS score of 4.2 (MEDIUM) reflects the requirement for user interaction and high attack complexity, but the silent failure of security controls is a serious concern. Organizations with strict SFTP security policies—particularly those using chroot jails or read-only restrictions for sensitive data—should prioritize patching. Conversely, environments where SFTP is lightly used or where all security configuration is within the first 9 arguments face lower immediate risk. The absence of public exploitation (not on the KEV list) suggests this is currently theoretical, but the logic flaw is straightforward enough that adversaries may exploit it once awareness spreads.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects: Attack Vector Network (arguments can be influenced remotely), Attack Complexity High (a specific configuration is needed), Privileges Required None (no prior access needed to trigger), User Interaction Required (an SFTP connection must be initiated), Confidentiality Impact Low (potential file access leakage), Integrity Impact Low (potential unauthorized modification), Availability Impact None. The score is anchored to a scenario where this weakness is one element in a broader attack chain, not an isolated remote code execution.

Frequently asked questions