PatchRadar

← Browse

CVE-2026-35385

Medium

Elevated severity or exploit probability.

CVSS base
7.5 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
0.6%
45.6th percentile
CISA KEV
Not listed
Weakness / dates
CWE-281
Published 2026-04-02 · modified 2026-09-01

CVSS breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorNNetwork
Attack ComplexityHHigh
Privileges RequiredNNone
User InteractionRRequired
ScopeUUnchanged
ConfidentialityHHigh
IntegrityHHigh
AvailabilityHHigh

Timeline

Description

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

Affected

openbsd

References

Official: NVD · CVE.org