The remote NewStart CGSL host, running version MAIN 7.02, has openssh packages installed that are affected by multiple vulnerabilities:

  - ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-     exchange. (This outcome occurs only on the client side.) (CVE-2026-60002)

  - In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to     some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without
    -p (preserve mode). (CVE-2026-35385)

  - In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a     command line. This requires a scenario where the username on the command line is untrusted, and also     requires a non-default configurations of % in ssh_config. (CVE-2026-35386)

  - OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in     PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.
    (CVE-2026-35387)

  - OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
    (CVE-2026-35388)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69266 advisory.

    * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)

    * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-59999)

    * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client     (CVE-2026-73282)

    Bug Fix(es) and Enhancement(s):

    * Incomplete backport of CVE-2023-38408 in Rocky Linux 8 openssh (JIRA:Rocky Linux-234763)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69129 advisory.

    * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)

    * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-59999)

    * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)

    * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)

    * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client     (CVE-2026-73282)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the openssh-9.9p1-12.el9 build changelog.

  - In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over     PermitTunnel=yes, but did not. (CVE-2026-59999)

  - sftp client allows attacker to control downloaded file location (CVE-2026-59995)

  - Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-73283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openssh package has been released.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.(CVE-2026-60001)

    sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption     from excessive authentication attempts) because MaxAuthTries was mishandled for     GSSAPIAuthentication.(CVE-2026-60000)

    In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over     PermitTunnel=yes, but did not.(CVE-2026-59999)

    scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy     occurs between two remote destinations.(CVE-2026-59996)

    ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-     exchange. (This outcome occurs only on the client side.)(CVE-2026-60002)

    sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when 'sftp     server:/path .' is used with an attacker-controlled server.(CVE-2026-59995)

    internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can     be important if a later command-line argument would have helped to ensure the intended security properties     of an SFTP connection.(CVE-2026-59997)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can     be important if a later command-line argument would have helped to ensure the intended security properties     of an SFTP connection.(CVE-2026-59997)

    scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy     occurs between two remote destinations.(CVE-2026-59996)

    sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption     from excessive authentication attempts) because MaxAuthTries was mishandled for     GSSAPIAuthentication.(CVE-2026-60000)

    In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over     PermitTunnel=yes, but did not.(CVE-2026-59999)

    ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-     exchange. (This outcome occurs only on the client side.)(CVE-2026-60002)

    sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.(CVE-2026-60001)

    sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when 'sftp     server:/path .' is used with an attacker-controlled server.(CVE-2026-59995)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76748 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux     OpenSSH client versions (CVE-2026-55655)

    * openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS     known-group validation leads to client-side denial of service (CVE-2026-55653)

    * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)

    * openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay     (CVE-2026-60001)

    * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-59999)

    * openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy (CVE-2026-59996)

    * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client     (CVE-2026-73282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
343592	NewStart CGSL MAIN 7.02 : openssh Multiple Vulnerabilities (NS-SA-2026-0101)	Nessus	NewStart CGSL Local Security Checks	2026/9/8	2026/9/8	critical
348760	RockyLinux 8 : openssh (RLSA-2026:69266)	Nessus	Rocky Linux Local Security Checks	2026/9/22	2026/9/22	high
348787	RockyLinux 10 : openssh (RLSA-2026:69129)	Nessus	Rocky Linux Local Security Checks	2026/9/22	2026/9/22	high
337899	CentOS 9 : openssh-9.9p1-12.el9	Nessus	CentOS Local Security Checks	2026/8/19	2026/8/19	high
332983	Photon OS 4.0: Openssh PHSA-2026-4.0-1059	Nessus	PhotonOS Local Security Checks	2026/8/6	2026/8/6	high
331582	Photon OS 5.0: Openssh PHSA-2026-5.0-0936	Nessus	PhotonOS Local Security Checks	2026/8/1	2026/10/14	high
364769	EulerOS 2.0 SP13 : openssh (EulerOS-SA-2026-4077)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	critical
364919	EulerOS 2.0 SP13 : openssh (EulerOS-SA-2026-4168)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	critical
364981	EulerOS 2.0 SP11 : openssh (EulerOS-SA-2026-4353)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	critical
363383	RHEL 10 : openssh (RHSA-2026:76748)	Nessus	Red Hat Local Security Checks	2026/10/6	2026/10/6	high

检测

插件搜索

critical

high

high

high

high

high

critical

critical

critical

high