Red Hat Security Advisory

RHSA-2026:47756

openssh security update

Released 2026-07-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) openssh-askpass-9.9p1-9.el9_8, pam_ssh_agent_auth-0.10.4-7.9.el9_8
Red Hat Enterprise Linux BaseOS (v. 9) openssh-9.9p1-9.el9_8, openssh-clients-9.9p1-9.el9_8, openssh-keycat-9.9p1-9.el9_8 +1

TI-2026-42784 CVE-2026-60002 · GHSA-gp5v-jg37-fvg6

MEDIUM 42

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.003 Published 2026-07-08 Partial fix · 10.4 CWE-416

TI-2026-40178 CVE-2026-55653 · GHSA-28f3-55mq-pp68

LOW 29

A flaw was found in OpenSSH.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0053 Published 2026-06-23 Partial fix · 9.9p1-25.el10_2, 9.9p1-7.el10_0.5 +46 CWE-415

TI-2026-40180 CVE-2026-55655 · GHSA-wcvf-3x75-j4c6

LOW 26

A flaw was found in OpenSSH.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00124 Published 2026-06-23 Partial fix · 9.9p1-25.el10_2, 9.9p1-7.el10_0.5 +46 CWE-923

TI-2026-42778 CVE-2026-59996 · GHSA-8v2x-fhq9-4fv3

LOW 24

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0025 Published 2026-07-08 Partial fix · 10.4 CWE-23

TI-2026-40179 CVE-2026-55654 · GHSA-5mx2-7g4j-9m39

LOW 19

A flaw was found in OpenSSH.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00652 Published 2026-06-23 Partial fix · 9.9p1-25.el10_2, 9.9p1-9.el9_8 +5 CWE-125