CVE-2026-59999
Openbsd Openssh ≤ 10.4
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2026-59999 is a medium-severity Use of Less Trusted Source (CWE-348) vulnerability in Openbsd Openssh. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique SSH (T1021.004); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and CM-6 (Configuration Settings) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42142
Vulnerability Data
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows an attacker to bypass the DisableForwarding=yes configuration when PermitTunnel=yes is set, enabling unauthorized SSH tunneling which directly maps to SSH remote services abuse.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended precedence of DisableForwarding over PermitTunnel so that tunnel forwarding cannot be activated when forwarding is explicitly disabled.
Ensures sshd_config settings are applied consistently and that contradictory options such as DisableForwarding and PermitTunnel are resolved according to policy.
Requires timely patching of OpenSSH to the fixed version (10.4+) so the precedence logic is corrected.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit authenticity/integrity checks before use directly reduce selection of a less-trusted source.
Correlating multiple sources can surface discrepancies that discourage reliance on the less-trusted one.
Protecting data-in-transit integrity helps ensure the more-trusted source is the one whose data is accepted.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles include trusted input channels and source verification mechanisms.
Security testing can detect and prevent acceptance of data from less-trusted sources during development.
Network security controls can enforce trusted data paths and source validation, reducing reliance on unverified inputs.
Secure network services include source validation and integrity checks that help prevent acceptance of data from less-trusted origins.
Application security requirements can mandate trusted data sources and input validation, directly addressing the weakness.
Secure coding practices can enforce checks that prefer or validate the more trusted data source.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-348
Oracle Linux 9 (1 rule)
- V-271525 OL 9 must have GPG signature verification enabled for all software repositories. via CWE-348