CVE-2026-35385

ADVISORY - nist

Summary

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

EPSS Score⁠: 0.00612 (0.464)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-281⁠

Improper Preservation of Permissions

ADVISORY - redhat

CWE-281⁠

Improper Preservation of Permissions

Impacted images

Advisories

Alpine

CREATED

4 months ago

UPDATED

21 days ago

ADVISORY IDCVE-2026-35385⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Package	Type	OS Name	OS Version	Affected Ranges	Fix Versions
alpine/openssh	apk	alpine	3.23	<=10.2_p1-r0	Not yet available
alpine/dropbear	apk	alpine	edge	<2026.91-r0	2026.91-r0
alpine/dropbear	apk	alpine	3.24	<2026.91-r0	2026.91-r0
alpine/openssh	apk	alpine	3.24	<10.3_p1-r0	10.3_p1-r0
alpine/openssh	apk	alpine	3.21	<=7.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=7.5_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.21	<=7.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.21	<=7.9_p1-r3	Not yet available
alpine/openssh	apk	alpine	3.21	<=8.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=8.5_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=8.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=9.6_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=9.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=9.9_p1-r2	Not yet available
alpine/openssh	apk	alpine	3.21	<=9.9_p2-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=7.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=7.5_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.19	<=7.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.19	<=7.9_p1-r3	Not yet available
alpine/openssh	apk	alpine	3.19	<=8.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=8.5_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=8.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=9.6_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=9.6_p1-r1	Not yet available
alpine/openssh	apk	alpine	3.19	<=9.6_p1-r2	Not yet available
alpine/openssh	apk	alpine	3.19	<=9.7_p2-r5	Not yet available
alpine/openssh	apk	alpine	3.22	<=10.0_p1-r10	Not yet available
alpine/openssh	apk	alpine	3.22	<=10.0_p1-r7	Not yet available
alpine/openssh	apk	alpine	3.22	<=10.0_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.22	<=10.0_p1-r9	Not yet available
alpine/openssh	apk	alpine	3.22	<=7.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=7.5_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.22	<=7.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.22	<=7.9_p1-r3	Not yet available
alpine/openssh	apk	alpine	3.22	<=8.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=8.5_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=8.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=9.6_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=9.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=9.9_p2-r0	Not yet available
alpine/openssh	apk	alpine	edge	<10.3_p1-r0	10.3_p1-r0
alpine/openssh	apk	alpine	3.20	<=7.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=7.5_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.20	<=7.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.20	<=7.9_p1-r3	Not yet available
alpine/openssh	apk	alpine	3.20	<=8.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=8.5_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=8.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=9.6_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=9.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.20	<=9.7_p1-r5	Not yet available

Severity and metrics

No CVSS data available from this advisory.

NIST

CREATED

5 months ago

UPDATED

4 months ago

ADVISORY IDCVE-2026-35385⁠

EXPLOITABILITY SCORE

1.6

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-281⁠

CVSS SCORE

7.5high

Debian

CREATED

5 months ago

UPDATED

3 months ago

ADVISORY IDCVE-2026-35385⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

5 months ago

UPDATED

1 month ago

ADVISORY IDCVE-2026-35385⁠

EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

8.1medium

Alma

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDALSA-2026:13381⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Alma

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDALSA-2026:13383⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Alma

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDALSA-2026:19219⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Amazon

CREATED

4 months ago

UPDATED

4 months ago

ADVISORY IDALAS2-2026-3262⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Amazon

CREATED

4 months ago

UPDATED

4 months ago

ADVISORY IDALAS2023-2026-1604⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Red Hat

CREATED

5 months ago

UPDATED

4 months ago

ADVISORY IDCVE-2026-35385⁠

EXPLOITABILITY SCORE

1.6

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-281⁠

CVSS SCORE

7.5high

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:13380⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:13381⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:13383⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:19069⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:19219⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDELSA-2026-13380⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDELSA-2026-13381⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDELSA-2026-13383⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

1 month ago

UPDATED

1 month ago

ADVISORY IDELSA-2026-19069⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

2 months ago

UPDATED

2 months ago

ADVISORY IDELSA-2026-19219⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

2 months ago

UPDATED

2 months ago

ADVISORY IDELSA-2026-22468⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

2 months ago

UPDATED

2 months ago

ADVISORY IDELSA-2026-50325⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Photon

CREATED

4 months ago

UPDATED

3 months ago

ADVISORY ID

CVE-2026-35385

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

8.1high