Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenSSH vulnerabilities (USN-8804-1)

🗓️ 23 Sep 2026 00:00:00Reported by TenableType 
nessus
 nessus🔗 www.tenable.com👁 3 Views

OpenSSH in Ubuntu 14.04/16.04/18.04/20.04 supports RCE, bypasses, and file modification.

Related
Refs
Code
ReporterTitlePublishedViews
Family
ibm
IBM Security Bulletins		Security Bulletin: Multiple vulnerabilities in OpenSSH affect AIX
11 Sep 202614:13
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Vulnerabilities in multiple components affect IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products
21 Jul 202614:51
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Multiple vulnerabilities in OpenSSH affect AIX
28 May 202621:05
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities due to OpenSSH
26 Aug 202609:39
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM i is Affected By Various Vulnerabilities in OpenSSH [CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388]
8 Jun 202620:09
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM i is Affected By Use of Less Trusted Source and Resource Allocation Without Throttling Vulnerabilities in OpenSSH [CVE-2026-59999, CVE-2026-60001]
10 Aug 202614:36
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Vulnerability in openssh library (CVE-2026-35387) affects Power HMC.
1 Jul 202613:52
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Vulnerabilities exists in IBM Netezza Software
20 Aug 202614:44
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
25 May 202613:53
–ibm
nessus
Tenable Nessus		AIX : Multiple Vulnerabilities (IJ59563)
21 Aug 202600:00
–nessus
Rows per page
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-8804-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(349265);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/23");

  script_cve_id(
    "CVE-2026-35386",
    "CVE-2026-35387",
    "CVE-2026-35414",
    "CVE-2026-59995",
    "CVE-2026-59997",
    "CVE-2026-59998",
    "CVE-2026-59999",
    "CVE-2026-60000",
    "CVE-2026-60001",
    "CVE-2026-73282"
  );
  script_xref(name:"IAVA", value:"2026-A-0296-S");
  script_xref(name:"IAVA", value:"2026-A-0691-S");
  script_xref(name:"IAVA", value:"2026-A-0847");
  script_xref(name:"USN", value:"8804-1");

  script_name(english:"Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenSSH vulnerabilities (USN-8804-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by
multiple vulnerabilities as referenced in the USN-8804-1 advisory.

    Florian Kohnhuser discovered that OpenSSH incorrectly handled shell metacharacters in certain usernames.
    An attacker could possibly use this issue to execute arbitrary commands when certain non-default
    configurations were used, resulting in arbitrary code execution. This issue only affected Ubuntu 14.04
    LTS. (CVE-2026-35386)

    Christos Papakonstantinou discovered that OpenSSH incorrectly handled ECDSA algorithm restrictions. An
    attacker could possibly use this issue to cause unintended ECDSA algorithms to be accepted, resulting in
    security restrictions being bypassed. (CVE-2026-35387)

    Vladimir Tokarev discovered that OpenSSH incorrectly handled certain principal restrictions in
    authorized_keys files. An attacker could possibly use this issue to bypass principal restrictions,
    resulting in unauthorized access. This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and Ubuntu
    20.04 LTS. (CVE-2026-35414)

    It was discovered that OpenSSH incorrectly handled downloaded file paths when using sftp with an untrusted
    server. An attacker could possibly use this issue to write downloaded files outside the intended location,
    resulting in unauthorized file modification. (CVE-2026-59995)

    It was discovered that OpenSSH incorrectly handled command-line arguments in internal-sftp. An attacker
    could possibly use this issue to cause certain security-related arguments to be ignored, resulting in
    security restrictions being bypassed. (CVE-2026-59997)

    It was discovered that OpenSSH incorrectly handled GSSAPIStrictAcceptorCheck when used with Windows Active
    Directory. An attacker could possibly use this issue to bypass GSSAPI security restrictions, resulting in
    unauthorized access. (CVE-2026-59998)

    It was discovered that OpenSSH incorrectly handled forwarding restrictions when DisableForwarding and
    PermitTunnel were used together. An attacker could possibly use this issue to create tunnels despite
    forwarding being disabled, resulting in security restrictions being bypassed. This issue only affected
    Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-59999)

    It was discovered that OpenSSH incorrectly handled authentication attempt limits when using GSSAPI
    authentication. An attacker could possibly use this issue to consume excessive system resources, resulting
    in a denial of service. (CVE-2026-60000)

    It was discovered that OpenSSH did not always enforce the minimum authentication delay. An attacker could
    possibly use this issue to perform authentication attempts more rapidly than intended, resulting in
    weakened brute-force protections. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-60001)

    It was discovered that OpenSSH incorrectly handled certain concurrent remote forwarding operations. An
    attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or
    arbitrary code execution. (CVE-2026-73282)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-8804-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-59999");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-35414");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-client-ssh1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-sftp-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssh-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ssh");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ssh-askpass-gnome");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ssh-krb5");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2026 Canonical, Inc. / NASL script (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('14.04' >< os_release || '16.04' >< os_release || '18.04' >< os_release || '20.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 14.04 / 16.04 / 18.04 / 20.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '14.04', 'pkgname': 'openssh-client', 'pkgver': '1:6.6p1-2ubuntu2.13+esm4', 'cves': ['CVE-2026-35386', 'CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '14.04', 'pkgname': 'openssh-server', 'pkgver': '1:6.6p1-2ubuntu2.13+esm4', 'cves': ['CVE-2026-35386', 'CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '14.04', 'pkgname': 'openssh-sftp-server', 'pkgver': '1:6.6p1-2ubuntu2.13+esm4', 'cves': ['CVE-2026-35386', 'CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '14.04', 'pkgname': 'ssh', 'pkgver': '1:6.6p1-2ubuntu2.13+esm4', 'cves': ['CVE-2026-35386', 'CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '14.04', 'pkgname': 'ssh-askpass-gnome', 'pkgver': '1:6.6p1-2ubuntu2.13+esm4', 'cves': ['CVE-2026-35386', 'CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '14.04', 'pkgname': 'ssh-krb5', 'pkgver': '1:6.6p1-2ubuntu2.13+esm4', 'cves': ['CVE-2026-35386', 'CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '16.04', 'pkgname': 'openssh-client', 'pkgver': '1:7.2p2-4ubuntu2.10+esm10', 'cves': ['CVE-2026-35387', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '16.04', 'pkgname': 'openssh-client-ssh1', 'pkgver': '1:7.2p2-4ubuntu2.10+esm10', 'cves': ['CVE-2026-35387', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '16.04', 'pkgname': 'openssh-server', 'pkgver': '1:7.2p2-4ubuntu2.10+esm10', 'cves': ['CVE-2026-35387', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '16.04', 'pkgname': 'openssh-sftp-server', 'pkgver': '1:7.2p2-4ubuntu2.10+esm10', 'cves': ['CVE-2026-35387', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '16.04', 'pkgname': 'ssh', 'pkgver': '1:7.2p2-4ubuntu2.10+esm10', 'cves': ['CVE-2026-35387', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '16.04', 'pkgname': 'ssh-askpass-gnome', 'pkgver': '1:7.2p2-4ubuntu2.10+esm10', 'cves': ['CVE-2026-35387', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '16.04', 'pkgname': 'ssh-krb5', 'pkgver': '1:7.2p2-4ubuntu2.10+esm10', 'cves': ['CVE-2026-35387', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '18.04', 'pkgname': 'openssh-client', 'pkgver': '1:7.6p1-4ubuntu0.7+esm6', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '18.04', 'pkgname': 'openssh-server', 'pkgver': '1:7.6p1-4ubuntu0.7+esm6', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '18.04', 'pkgname': 'openssh-sftp-server', 'pkgver': '1:7.6p1-4ubuntu0.7+esm6', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '18.04', 'pkgname': 'ssh', 'pkgver': '1:7.6p1-4ubuntu0.7+esm6', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '18.04', 'pkgname': 'ssh-askpass-gnome', 'pkgver': '1:7.6p1-4ubuntu0.7+esm6', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-73282']},
    {'osver': '20.04', 'pkgname': 'openssh-client', 'pkgver': '1:8.2p1-4ubuntu0.13+esm3', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-60001', 'CVE-2026-73282']},
    {'osver': '20.04', 'pkgname': 'openssh-server', 'pkgver': '1:8.2p1-4ubuntu0.13+esm3', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-60001', 'CVE-2026-73282']},
    {'osver': '20.04', 'pkgname': 'openssh-sftp-server', 'pkgver': '1:8.2p1-4ubuntu0.13+esm3', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-60001', 'CVE-2026-73282']},
    {'osver': '20.04', 'pkgname': 'openssh-tests', 'pkgver': '1:8.2p1-4ubuntu0.13+esm3', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-60001', 'CVE-2026-73282']},
    {'osver': '20.04', 'pkgname': 'ssh', 'pkgver': '1:8.2p1-4ubuntu0.13+esm3', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-60001', 'CVE-2026-73282']},
    {'osver': '20.04', 'pkgname': 'ssh-askpass-gnome', 'pkgver': '1:8.2p1-4ubuntu0.13+esm3', 'cves': ['CVE-2026-35387', 'CVE-2026-35414', 'CVE-2026-59995', 'CVE-2026-59997', 'CVE-2026-59998', 'CVE-2026-59999', 'CVE-2026-60000', 'CVE-2026-60001', 'CVE-2026-73282']}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (osver && pkgname && pkgver) {
    if (deb_check(release:osver, prefix:pkgname, reference:pkgver, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = '';
  extra += ubuntu_report_get();
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : extra
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'openssh-client / openssh-client-ssh1 / openssh-server / etc');
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
23 Sep 2026 00:00Current
7.1High risk
Vulners AI Score7.1
CVSS 3.16.5 - 8.1
EPSS0.01155
SSVC
OpenSSHarbitrary code executionsecurity restrictions bypassedunauthorized accessunauthorized file modificationsftp
3