OpenSSH (Product): news timeline & CVEs

USN-8804-1: OpenSSH vulnerabilities

Ubuntu patched two OpenSSH flaws, including command execution on 14.04 and an ECDSA bypass.

Ubuntu Security Notice USN-8804-1 covers two OpenSSH vulnerabilities. CVE-2026-35386 involves incorrect handling of shell metacharacters in certain usernames, which could allow arbitrary command execution, but only on Ubuntu 14.04 LTS and only with certain non-default configurations. CVE-2026-35387 involves incorrect ECDSA algorithm restrictions that could let unintended ECDSA algorithms be accepted and bypass security restrictions. The notice does not report active exploitation.

Ubuntu Security NoticesSep 22, 14:24 UTC · 4d agoAdvisory CVE-2026-35386 CVE-2026-35387

USN-8514-2: OpenSSH vulnerability

Ubuntu backports an OpenSSH fix to older LTS releases for an scp flaw enabling setuid file placement and privilege escalation.

USN-8514-2 extends the USN-8514-1 OpenSSH fix to Ubuntu 14.04 LTS, 18.04 LTS, and 20.04 LTS. The flaw stems from incorrect file permission handling when downloading files as root using the legacy scp protocol without the preserve-mode option. An attacker could exploit this to install setuid or setgid files on the system, potentially leading to privilege escalation.

Ubuntu Security NoticesSep 16, 08:46 UTC · 11d agoVulnerability

OpenSSH

Timeline2 articles

Related CVEsby mentions

Appears with

USN-8804-1: OpenSSH vulnerabilities

USN-8514-2: OpenSSH vulnerability