The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016493 advisory.

    OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a     principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4584 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4584-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Santiago Ruano Rincn     May 15, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openssh     Version        : 1:8.4p1-5+deb11u7     CVE ID         : CVE-2025-61984 CVE-2025-61985 CVE-2026-35385 CVE-2026-35386                      CVE-2026-35387 CVE-2026-35388 CVE-2026-35414     Debian Bug     : 1117529 1117530 1132572 1132573 1132574 1132575 1132576

    Several vulnerabilities have been discovered in OpenSSH, an implementation of     the SSH protocol suite.

    CVE-2025-61984

        ssh allows control characters in usernames that originate from certain         possibly untrusted sources, potentially leading to code execution when a         ProxyCommand is used.

    CVE-2025-61985

        ssh allows the '\0' character in an ssh:// URI, potentially leading to code         execution when a ProxyCommand is used.

    CVE-2026-35385

        When downloading files as root in legacy (-O) mode and without the -p         (preserve modes) flag set, scp did not clear setuid/setgid bits from         downloaded files as one might typically expect.  This bug dates back to the         original Berkeley rcp program.  Reported by Christos Papakonstantinou of         Cantina and Spearbit.

    CVE-2026-35386

        Validation of shell metacharacters in user names supplied on the         command-line was performed too late to prevent some situations where they         could be expanded from %-tokens in ssh_config. For certain configurations,         such as those that use a %u token in a Match exec block, an attacker         who can control the user name passed to ssh(1) could potentially execute         arbitrary shell commands. Reported by Florian Kohnhuser.

        OpenSSH developers continue to recommend against directly exposing ssh(1)         and other tools' command-lines to untrusted input. Mitigations as the one         addressing this issue can not be absolute given the variety of shells and         user configurations in use.

    CVE-2026-35387

        ssh can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in         PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted         to mean all ECDSA algorithms. Reported by Christos Papakonstantinou of         Cantina and Spearbit.

    CVE-2026-35388

        Connection multiplexing confirmation (requested using ControlMaster         ask/autoask) was not being tested for proxy mode multiplexing sessions (i.e.
        ssh -O proxy ...). Reported by Michalis Vasileiadis.

    CVE-2026-35414

        When matching an authorized_keys principals= option against a list of         principals in a certificate, an incorrect algorithm was used that could         allow inappropriate matching in cases where a principal name in the         certificate contains a comma character. Exploitation of the condition requires         an authorized_keys principals= option that lists more than one principal
        *and* a CA that will issue a certificate that encodes more than one of         these principal names separated by a comma (typical CAs strongly constrain         which principal names they will place in a certificate). This condition         only applies to user- trusted CA keys in authorized_keys, the main         certificate authentication path         (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported by         Vladimir Tokarev.

    For Debian 11 bullseye, these problems have been fixed in version     1:8.4p1-5+deb11u7.

    We recommend that you upgrade your openssh packages.

    For the detailed security status of openssh please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openssh

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:12389 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode     (CVE-2026-35385)

    * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414)

    * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage     (CVE-2026-35387)

    * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions     (CVE-2026-35388)

    * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2375-1 advisory.

    This update for openssh fixes the following issues

    - CVE-2026-3497: information disclosure or denial of service due to uninitialized variables (bsc#1259642).
    - CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid (bsc#1261427).
    - CVE-2026-35388: omitted connection multiplexing confirmation for proxy-mode multiplexing sessions     (bsc#1261441).
    - CVE-2026-35414: mishandling of authorized_keys principals option (bsc#1261430).
    - potential security issue when validating mac (bsc#1264568).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
312833	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: openssh (UTSA-2026-016493)	Nessus	Unity Linux Local Security Checks	2026/5/7	2026/5/7	high
314975	Debian dla-4584 : openssh-client - security update	Nessus	Debian Local Security Checks	2026/5/15	2026/5/15	high
311349	RHEL 10 : openssh (RHSA-2026:12389)	Nessus	Red Hat Local Security Checks	2026/4/30	2026/4/30	high
320998	SUSE SLES15 Security Update : openssh (SUSE-SU-2026:2375-1)	Nessus	SuSE Local Security Checks	2026/6/14	2026/6/14	medium

检测

插件搜索

high

high

high

medium