The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016786 advisory.

    Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability     affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream     project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows     an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which     will call the underlying function and continue the execution of the program without setting the related     connection variables. As the variables are not initialized to NULL the code later accesses those     uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended     workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the     vulnerability depends heavily on the compiler flag hardening configuration.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-9.9p1-7.el9 build changelog.

  - Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex     (CVE-2026-3497)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:15891 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables     (CVE-2026-3497)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:15893 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables     (CVE-2026-3497)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a     principals list in conjunction with a Certificate Authority that makes certain use of comma     characters.(CVE-2026-35414)

    In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a     command line. This requires a scenario where the username on the command line is untrusted, and also     requires a non-default configurations of % in ssh_config.(CVE-2026-35386)

    In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to     some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without
    -p (preserve mode).(CVE-2026-35385)

    Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability     affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream     project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows     an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which     will call the underlying function and continue the execution of the program without setting the related     connection variables. As the variables are not initialized to NULL the code later accesses those     uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended     workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the     vulnerability depends heavily on the compiler flag hardening configuration.(CVE-2026-3497)

    OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in     PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA     algorithms.(CVE-2026-35387)

    OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing     sessions.(CVE-2026-35388)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing     sessions.(CVE-2026-35388)

    OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a     principals list in conjunction with a Certificate Authority that makes certain use of comma     characters.(CVE-2026-35414)

    In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a     command line. This requires a scenario where the username on the command line is untrusted, and also     requires a non-default configurations of % in ssh_config.(CVE-2026-35386)

    In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to     some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without
    -p (preserve mode).(CVE-2026-35385)

    OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in     PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA     algorithms.(CVE-2026-35387)

    Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability     affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream     project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows     an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which     will call the underlying function and continue the execution of the program without setting the related     connection variables. As the variables are not initialized to NULL the code later accesses those     uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended     workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the     vulnerability depends heavily on the compiler flag hardening configuration.(CVE-2026-3497)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the  packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to     some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without
    -p (preserve mode).(CVE-2026-35385)

    In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a     command line. This requires a scenario where the username on the command line is untrusted, and also     requires a non-default configurations of % in ssh_config.(CVE-2026-35386)

    OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a     principals list in conjunction with a Certificate Authority that makes certain use of comma     characters.(CVE-2026-35414)

    Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability     affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream     project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows     an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which     will call the underlying function and continue the execution of the program without setting the related     connection variables. As the variables are not initialized to NULL the code later accesses those     uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended     workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the     vulnerability depends heavily on the compiler flag hardening configuration.(CVE-2026-3497)

    OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in     PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA     algorithms.(CVE-2026-35387)

    OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing     sessions.(CVE-2026-35388)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-408:01 advisory.

    * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables     (CVE-2026-3497)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:6461 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables     (CVE-2026-3497)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-6463 advisory.

    [9.9p1-13.0.1]
    - Upstream references found with /usr/bin/ssh [Orabug: 37824421]

    [9.9p1-13]
    - CVE-2026-3497: Fix information disclosure or denial of service due       to uninitialized variables in gssapi-keyex       Resolves: RHEL-155811

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-6461 advisory.

    [8.0p1-28.0.1]
    - Update upstream references [Orabug: 36587718]

    [8.0p1-28]
    - CVE-2026-3497: Fix information disclosure or denial of service due       to uninitialized variables in gssapi-keyex       Resolves: RHEL-155814

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:6461 advisory.

    * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables     (CVE-2026-3497)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10714 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables     (CVE-2026-3497)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:14924 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables     (CVE-2026-3497)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a     principals list in conjunction with a Certificate Authority that makes certain use of comma     characters.(CVE-2026-35414)

    In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a     command line. This requires a scenario where the username on the command line is untrusted, and also     requires a non-default configurations of % in ssh_config.(CVE-2026-35386)

    In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to     some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without
    -p (preserve mode).(CVE-2026-35385)

    Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability     affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream     project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows     an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which     will call the underlying function and continue the execution of the program without setting the related     connection variables. As the variables are not initialized to NULL the code later accesses those     uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended     workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the     vulnerability depends heavily on the compiler flag hardening configuration.(CVE-2026-3497)

    OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in     PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA     algorithms.(CVE-2026-35387)

    OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing     sessions.(CVE-2026-35388)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2375-1 advisory.

    This update for openssh fixes the following issues

    - CVE-2026-3497: information disclosure or denial of service due to uninitialized variables (bsc#1259642).
    - CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid (bsc#1261427).
    - CVE-2026-35388: omitted connection multiplexing confirmation for proxy-mode multiplexing sessions     (bsc#1261441).
    - CVE-2026-35414: mishandling of authorized_keys principals option (bsc#1261430).
    - potential security issue when validating mac (bsc#1264568).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6204 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6204-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     April 09, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openssh     CVE ID         : CVE-2026-3497     Debian Bug     : 1130595

    Jeremy Brown discovered a flaw in the GSSAPI Key Exchange patch applied     in Debian to OpenSSH, an implementation of the SSH protocol suite,     affecting non-default configurations with the GSSAPIKeyExchange setting     enabled. A remote attacker can take advantage of this flaw to cause a     denial of service, or potentially the execution of arbitrary code.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 1:9.2p1-2+deb12u9. This update includes fixes for     CVE-2025-61984 and CVE-2025-61985 which were queued for the Debian     bookworm 12.14 point release.

    For the stable distribution (trixie), this problem has been fixed in     version 1:10.0p1-7+deb13u2.

    We recommend that you upgrade your openssh packages.

    For the detailed security status of openssh please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/openssh

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to     some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without
    -p (preserve mode).(CVE-2026-35385)

    In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a     command line. This requires a scenario where the username on the command line is untrusted, and also     requires a non-default configurations of % in ssh_config.(CVE-2026-35386)

    OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a     principals list in conjunction with a Certificate Authority that makes certain use of comma     characters.(CVE-2026-35414)

    Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability     affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream     project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows     an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which     will call the underlying function and continue the execution of the program without setting the related     connection variables. As the variables are not initialized to NULL the code later accesses those     uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended     workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the     vulnerability depends heavily on the compiler flag hardening configuration.(CVE-2026-3497)

    OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in     PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA     algorithms.(CVE-2026-35387)

    OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing     sessions.(CVE-2026-35388)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
313485	Unity Linux 20.1060e / 20.1070e Security Update: openssh (UTSA-2026-016786)	Nessus	Unity Linux Local Security Checks	2026/5/9	2026/6/12	medium
304416	CentOS 9 : openssh-9.9p1-7.el9	Nessus	CentOS Local Security Checks	2026/3/31	2026/3/31	medium
313740	RHEL 8 : openssh (RHSA-2026:15891)	Nessus	Red Hat Local Security Checks	2026/5/11	2026/6/10	medium
313743	RHEL 8 : openssh (RHSA-2026:15893)	Nessus	Red Hat Local Security Checks	2026/5/11	2026/6/10	medium
320734	EulerOS Virtualization 2.13.1 : openssh (EulerOS-SA-2026-2382)	Nessus	Huawei Local Security Checks	2026/6/12	2026/6/12	medium
323167	EulerOS 2.0 SP15 : openssh (EulerOS-SA-2026-2455)	Nessus	Huawei Local Security Checks	2026/6/27	2026/6/27	medium
328616	EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2744)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/21	medium
305058	MiracleLinux 8 : openssh-8.0p1-28.el8_10 (AXSA:2026-408:01)	Nessus	Miracle Linux Local Security Checks	2026/4/6	2026/4/6	medium
304730	RHEL 8 : openssh (RHSA-2026:6461)	Nessus	Red Hat Local Security Checks	2026/4/3	2026/4/3	medium
304799	Oracle Linux 10 : openssh (ELSA-2026-6463)	Nessus	Oracle Linux Local Security Checks	2026/4/3	2026/4/3	medium
304802	Oracle Linux 8 : openssh (ELSA-2026-6461)	Nessus	Oracle Linux Local Security Checks	2026/4/3	2026/4/3	medium
305660	RockyLinux 8 : openssh (RLSA-2026:6461)	Nessus	Rocky Linux Local Security Checks	2026/4/9	2026/4/9	medium
310396	RHEL 9 : openssh (RHSA-2026:10714)	Nessus	Red Hat Local Security Checks	2026/4/27	2026/4/27	medium
313170	RHEL 8 : openssh (RHSA-2026:14924)	Nessus	Red Hat Local Security Checks	2026/5/7	2026/5/7	medium
320258	EulerOS 2.0 SP13 : openssh (EulerOS-SA-2026-2348)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/10	medium
320998	SUSE SLES15 Security Update : openssh (SUSE-SU-2026:2375-1)	Nessus	SuSE Local Security Checks	2026/6/14	2026/6/14	medium
307671	Debian dsa-6204 : openssh-client - security update	Nessus	Debian Local Security Checks	2026/4/21	2026/4/21	medium
328552	EulerOS Virtualization 2.12.0 : openssh (EulerOS-SA-2026-2790)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/21	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium