CVE-2026-59997
Openbsd Openssh ≤ 10.4
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NSummary
CVE-2026-59997 is a medium-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Openbsd Openssh. Its CVSS base score is 4.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique SSH (T1021.004); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42139
Vulnerability Data
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in OpenSSH's internal-sftp limits recognition to the first 9 command-line arguments, potentially allowing bypass of security configurations for SFTP connections, which maps to exploitation of SSH remote services.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
CM-6 enforces secure configuration settings for sshd, ensuring the internal-sftp subsystem receives the full intended command-line arguments rather than being truncated at nine.
CM-7 restricts unnecessary or unsafe functionality in OpenSSH, limiting exposure if an incomplete SFTP argument list weakens security properties.
SI-2 drives timely patching of OpenSSH to a version (≥10.4) that correctly processes all SFTP command-line arguments.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper quantity/length validation in input handling.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect missing quantity validation but does not itself implement the control.
Secure development lifecycle mandates input validation for quantity fields, directly preventing CWE-1284.
Application security requirements explicitly call for validation of size/length inputs, mitigating CWE-1284.
Secure architecture principles encourage robust input handling but do not specifically address quantity validation.
Secure coding standards require explicit checks on numeric quantity inputs, fully addressing CWE-1284.