In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

🗓️ 04 Apr 2026 08:02:20Reported by MicrosoftType

mscve🔗 msrc.microsoft.com👁 11 Views

Microsoft vulnerability CVE-2026-35386 has been identified.

Reporter	Title	Published	Views	Family All 178
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in OpenSSH affect AIX	28 May 202621:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities due to OpenSSH	26 Aug 202609:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Various Vulnerabilities in OpenSSH [CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388]	8 Jun 202620:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	25 May 202613:53	–	ibm
ATTACKERKB	CVE-2026-35386	2 Apr 202616:44	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2026-1745)	27 May 202600:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0102: openssh (ALINUX3-SA-2026:0102)	18 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : openssh (ALSA-2026:13380)	4 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : openssh (ALSA-2026:13381)	5 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : openssh (ALSA-2026:13383)	4 May 202600:00	–	nessus

Vulners

Node

microsoft azl3_openssh_9.8p1-5Range<9.8p1-6

11 Apr 2026 08:39Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.13.6 - 8.1

EPSS0.00319

SSVC

cve-2026-35386 microsoft