In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-93679cc7c2 advisory.

    - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode
    - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions
    - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms     with regard to ECDSA keys
    - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openssh package has been released.

The version of OpenSSH installed on the remote host is prior to 10.3. It is, therefore, affected by multiple vulnerabilities as referenced in the release-10.3 advisory.

  - In OpenSSH before 10.3, validation of shell metacharacters in user names supplied on the command-line     was performed too late, allowing potential expansion from %-tokens in ssh_config. For configurations     that use a %u token in a Match exec block, an attacker who can control the user name passed to ssh(1)     could potentially execute arbitrary shell commands. (CVE-2026-35386)

  - In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary     to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and     without -p (preserve mode). (CVE-2026-35385)

  - OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in     PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.
    (CVE-2026-35387)

  - In OpenSSH before 10.3, connection multiplexing confirmation (requested using ControlMaster ask/autoask)     was not being tested for proxy mode multiplexing sessions (i.e. ssh -O proxy ...). (CVE-2026-35388)

  - OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a     principals list in conjunction with a Certificate Authority that makes certain use of comma characters.     (CVE-2026-35414)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to     some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without
    -p (preserve mode). (CVE-2026-35385)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310219	Fedora 44 : openssh (2026-93679cc7c2)	Nessus	Fedora Local Security Checks	high
310102	Photon OS 5.0: Openssh PHSA-2026-5.0-0830	Nessus	PhotonOS Local Security Checks	high
310099	Photon OS 4.0: Openssh PHSA-2026-4.0-1002	Nessus	PhotonOS Local Security Checks	high
306743	OpenSSH < 10.3 Multiple Vulnerabilities	Nessus	Misc.	high
304832	Linux Distros Unpatched Vulnerability : CVE-2026-35385	Nessus	Misc.	high

Detections

Analytics

CVE-2026-35385

high

Tenable Plugins

high

high

high

high

high