CVE-2026-35385: openbsd openssh Improper Preservation of Permissions
CVSS: 8.1v3.1HighModified
AliasesALPINE-CVE-2026-35385RHSA-2026:22468RHSA-2026:25063UBUNTU-CVE-2026-35385USN-8514-1USN-8514-2DEBIAN-CVE-2026-35385
Published 02-04-2026Last modified 01-09-2026
Vulnerability summary
CVE-2026-35385 is a high (CVSS 8.1) Improper Preservation of Permissions vulnerability in openbsd openssh. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.3% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
0.63%
0%100%
Low · +0.07 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 20 · Related 8MGASA-2026-0193OPENSUSE-SU-2026:10804-1RHSA-2026:12389RHSA-2026:13380RHSA-2026:13381RHSA-2026:13383RHSA-2026:16059RHSA-2026:19069RHSA-2026:19219RHSA-2026:21298RHSA-2026:21398RHSA-2026:22329RHSA-2026:22564RHSA-2026:22648SUSE-SU-2026:23249-1SUSE-SU-2026:2371-1SUSE-SU-2026:2375-1SUSE-SU-2026:2395-1SUSE-SU-2026:2430-1SUSE-SU-2026:2515-1USN-8222-1
Timeline
- 02-04-2026PublishedVulnerability first disclosed.
- 01-09-2026Last modifiedVulnerability information updated.
Description
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
CVSS metrics
6 scores · 6 sources · 1 versionHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSources6 sources · 7.5–8.1
- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · AlpineEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.07 pp
From 0.56% on 19-09-2026
19-09-202619-10-2026
EPSS score0.63%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat2 products
- openssh< 0:5.3p1-125.el6_10.1 | < 0:7.4p1-23.el7_9.2
- openssh-clients< 0:5.3p1-125.el6_10.1 | < 0:7.4p1-23.el7_9.2
Ubuntu2 products
- openssh< 1:6.6p1-2ubuntu2.13+esm3 | < 1:7.2p2-4ubuntu2.10+esm8 | All versions (No fix recorded) | < 1:7.6p1-4ubuntu0.7+esm5 | < 1:8.2p1-4ubuntu0.13+esm2 | < 1:8.9p1-3ubuntu0.15 | < 1:8.9p1-3ubuntu0.15+Fips1 | < 1:9.6p1-3ubuntu13.16 | < 1:9.6p1-3ubuntu13.16+Fips1 | < 1:10.0p1-5ubuntu5.4 | < 1:10.2p1-2ubuntu3.2
- openssh-ssh1All versions (No fix recorded)
Alpine1 product
- dropbear< 2026.91-r0
Debian1 product
- openssh< 1:9.2p1-2+deb12u10 | < 1:10.0p1-7+deb13u3 | < 1:10.3p1-1
Openbsd1 product
- openssh< 10.3
5 vendors · 7 products
