In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69130 advisory.

    - CVE-2026-73283: Complete the fix of security bypass due to incorrect       handling of forwarding and tunneling options       Resolves: RHEL-245416
    - CVE-2026-73281: Fix misinteraction between agent locking and       the session-bind@openssh.com extension       Resolves: RHEL-245424
    - CVE-2026-73282: Fix information disclosure and data corruption       via use-after-free in ssh client       Resolves: RHEL-245419
    - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded       file location       Resolves: RHEL-236320

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69130 advisory.

    * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)

    * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-59999)

    * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)

    * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)

    * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client     (CVE-2026-73282)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69129 advisory.

    * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)
      * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-59999)
      * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)
      * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)
      * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client     (CVE-2026-73282)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69129 advisory.

    * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)

    * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-59999)

    * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)

    * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)

    * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client     (CVE-2026-73282)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69130 advisory.

    * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)
      * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-59999)
      * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)
      * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)
      * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client     (CVE-2026-73282)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69130 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)

    * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-59999)

    * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)

    * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)

    * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client     (CVE-2026-73282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69129 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)

    * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-59999)

    * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283)

    * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281)

    * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client     (CVE-2026-73282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8721-1 advisory.

    It was discovered that OpenSSH's ssh-agent incorrectly handled interactions between agent locking and the     session-bind@openssh.com extension. A remote attacker with access to a forwarded agent connection could     possibly use this issue to perform operations that should only be available locally, such as adding tokens     or using keys. (CVE-2026-73281)

    It was discovered that OpenSSH's ssh client incorrectly handled concurrent remote-forwarding operations. A     remote attacker could possibly use this issue to cause a use-after-free condition, resulting in a denial     of service or the execution of arbitrary code. (CVE-2026-73282)

    It was discovered that OpenSSH's sshd server incorrectly applied the restrict keyword from authorized_keys     to tunnel forwarding requests. A local attacker with an authorized key could possibly use this issue to     bypass intended tunnel forwarding restrictions. (CVE-2026-73283)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the openssh-9.9p1-13.el9 build changelog.

  - Fix information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282)

  - Fix misinteraction between agent locking and the session-bind@openssh.com extension (CVE-2026-73281)

  - Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-73283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSH installed on the remote host is prior to 10.5. It is, therefore, affected by multiple vulnerabilities as referenced in the release-10.5 advisory.

  - In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of     remote-forwarding operations are concurrent. (CVE-2026-73282)

  - In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only     locally, including operations that add tokens or use keys. This is caused by misinteraction between agent     locking and the session-bind@openssh.com extension. (CVE-2026-73281)

  - In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to     tunnel forwarding but was not. (CVE-2026-73283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only     locally, including operations that add tokens or use keys. This is caused by misinteraction between agent     locking and the session-bind@openssh.com extension. (CVE-2026-73281)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349135	Oracle Linux 9 : openssh (ELSA-2026-69130)	Nessus	Oracle Linux Local Security Checks	Local	high
349094	RockyLinux 9 : openssh (RLSA-2026:69130)	Nessus	Rocky Linux Local Security Checks	Local	high
348810	AlmaLinux 10 : openssh (ALSA-2026:69129)	Nessus	Alma Linux Local Security Checks	Local	high
348787	RockyLinux 10 : openssh (RLSA-2026:69129)	Nessus	Rocky Linux Local Security Checks	Local	high
348735	AlmaLinux 9 : openssh (ALSA-2026:69130)	Nessus	Alma Linux Local Security Checks	Local	high
348588	RHEL 9 : openssh (RHSA-2026:69130)	Nessus	Red Hat Local Security Checks	Local	high
348400	RHEL 10 : openssh (RHSA-2026:69129)	Nessus	Red Hat Local Security Checks	Local	high
344614	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : OpenSSH vulnerabilities (USN-8721-1)	Nessus	Ubuntu Local Security Checks	Local	medium
339711	CentOS 9 : openssh-9.9p1-13.el9	Nessus	CentOS Local Security Checks	Local	medium
335161	OpenSSH < 10.5 Multiple Vulnerabilities	Nessus	Misc.	Remote	medium
334911	Linux Distros Unpatched Vulnerability : CVE-2026-73281	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-73281

low

Tenable Plugins

high

high

high

high

high

high

high

medium

medium

medium

low