CVE-2026-35386: openbsd openssh Incorrect Behavior Order
CVSS: 8.1v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-35386DEBIAN-CVE-2026-35386
Published 02-04-2026Last modified 03-04-2026
Vulnerability summary
CVE-2026-35386 is a high (CVSS 8.1) Incorrect Behavior Order vulnerability in openbsd openssh. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 27.8% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
0.36%
0%100%
Low · +0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 14 · Related 2Timeline
- 02-04-2026PublishedVulnerability first disclosed.
- 03-04-2026Last modifiedVulnerability information updated.
Description
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSources4 sources · 3.6–8.1
- CVE.orgCNA3.6LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
+0.04 pp
From 0.32% on 19-09-2026
19-09-202619-10-2026
EPSS score0.36%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- openssh< 1:6.6p1-2ubuntu2.13+esm4 | All versions (No fix recorded) | < 1:8.9p1-3ubuntu0.15 | < 1:8.9p1-3ubuntu0.15+Fips1 | < 1:9.6p1-3ubuntu13.16 | < 1:9.6p1-3ubuntu13.16+Fips1 | < 1:10.0p1-5ubuntu5.4 | < 1:10.2p1-2ubuntu3.2
- openssh-ssh1All versions (No fix recorded)
Debian1 product
- openssh< 1:9.2p1-2+deb12u10 | < 1:10.0p1-7+deb13u3 | < 1:10.3p1-1
Openbsd1 product
- openssh< 10.3 | ≥ 10.0, < 10.3
3 vendors · 4 products
References
9 links- marc.info?l=openssh-unix-dev&m=177513443901484&w=2Third Party Advisory
- www.openwall.com/lists/oss-security/2026/04/02/3Third Party Advisory
