Detections
Analytics
EulerOS 2.0 SP15 : openssh (EulerOS-SA-2026-3995)
critical Nessus Plugin ID 364034
Synopsis
The remote EulerOS host is missing multiple security updates.Description
According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.(CVE-2026-60000)
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.(CVE-2026-59996)
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re- exchange. (This outcome occurs only on the client side.)(CVE-2026-60002)
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.(CVE-2026-59997)
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when 'sftp server:/path .' is used with an attacker-controlled server.(CVE-2026-59995)
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.(CVE-2026-59999)
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.(CVE-2026-60001)
Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected openssh packages.See Also
Plugin Details
Severity: Critical
ID: 364034
File Name: EulerOS_SA-2026-3995.nasl
Version: 1.1
Type: Local
Family: Huawei Local Security Checks
Published: 10/8/2026
Updated: 10/8/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.5
Percentile: 57.6
CVSS v2
Risk Factor: High
Base Score: 9.7
Temporal Score: 7.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P
CVSS Score Source: CVE-2026-60002
CVSS v3
Risk Factor: Critical
Base Score: 9.4
Temporal Score: 8.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:huawei:euleros:2.0, p-cpe:/a:huawei:euleros:openssh-clients, p-cpe:/a:huawei:euleros:openssh-help, p-cpe:/a:huawei:euleros:openssh-server, p-cpe:/a:huawei:euleros:openssh, p-cpe:/a:huawei:euleros:pam_ssh_agent_auth
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp
Excluded KB Items: Host/EulerOS/uvp_version
Exploit Ease: No known exploits are available
Patch Publication Date: 10/8/2026
Vulnerability Publication Date: 7/8/2026
Reference Information
CVE: CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59999, CVE-2026-60000, CVE-2026-60001, CVE-2026-60002
IAVA: 2026-A-0691-S