USN-8804-1: OpenSSH vulnerabilities
Ubuntu patched two OpenSSH flaws, including command execution on 14.04 and an ECDSA bypass.
Ubuntu Security Notice USN-8804-1 covers two OpenSSH vulnerabilities. CVE-2026-35386 involves incorrect handling of shell metacharacters in certain usernames, which could allow arbitrary command execution, but only on Ubuntu 14.04 LTS and only with certain non-default configurations. CVE-2026-35387 involves incorrect ECDSA algorithm restrictions that could let unintended ECDSA algorithms be accepted and bypass security restrictions. The notice does not report active exploitation.
- CVE-2026-35386 allows command execution via metacharacters in usernames.
- That issue affects only Ubuntu 14.04 LTS with non-default configurations.
- CVE-2026-35387 can let unintended ECDSA algorithms be accepted.
- USN-8804-1 covers the OpenSSH fixes; active exploitation is not reported.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-35386+1 related CVE | In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line | 8.1 group max | <1% |
From the original article
Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell metacharacters in certain usernames. An attacker could possibly use this issue to execute arbitrary commands when certain non-default configurations were used, resulting in arbitrary code execution. This issue only affected Ubuntu 14.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.