CVE-2026-35385
Published Apr 2, 2026
·Updated
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
Affected Software
2 affected componentsFixes available
Microsoft azl3 openssh 9.8p1-5
OpenBSD OpenSSH<10.3
Event History
Apr 2, 2026
CVE Published
via MITRE·04:30 PM
Data Sourced
via MITRE·04:30 PM
DescriptionSeverityWeakness
Data Sourced
via Red Hat·05:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Apr 4, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:02 AM
Severity
Frequently Asked Questions
1
What is the severity of CVE-2026-35385?
CVE-2026-35385 is considered a moderate severity vulnerability affecting OpenSSH prior to version 10.3.
2
How do I fix CVE-2026-35385?
To fix CVE-2026-35385, upgrade OpenSSH to version 10.3 or later.
3
What impact does CVE-2026-35385 have on system security?
CVE-2026-35385 can lead to unexpected setuid/setgid permissions on files downloaded using scp as root.
4
Who is affected by CVE-2026-35385?
Any users or administrators utilizing OpenSSH versions before 10.3 with legacy scp protocol are affected by CVE-2026-35385.
5
Is CVE-2026-35385 a zero-day vulnerability?
No, CVE-2026-35385 is not a zero-day vulnerability as it has been publicly disclosed and patches are available.