CVE-2026-35386
LowCVSS 3.6Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration of % in ssh_config.
Risk Assessment
An attacker can remotely execute arbitrary commands on the server, leading to full system compromise.
Recommendation
Update OpenSSH to version 10.3 or later and avoid using untrusted usernames in command lines.
Original NVD description (English source)
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.