Medium severity4.8NVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026

CVE-2026-59998

Description

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.

Affected products

OpenBSD/OpenSSHinferred2 versions
<10.4+ 1 more
- (no CPE)range: <10.4
- cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*range: <10.4
OpenSSH/OpenSSHllm-fuzzy
Range: <10.4
osv-coords2 versions
pkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/openssh-askpass-gnome&distro=openSUSE%20Leap%2016.0
< 10.0p2-160000.7.1+ 1 more
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 10.0p2-160000.7.1

Patches

Vulnerability mechanics

References

marc.infonvdRelease Notes
www.openssh.org/releasenotes.htmlnvdRelease Notes
www.openwall.com/lists/oss-security/2026/07/06/5nvdMailing ListRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000