OpenSSH CVE-2026-59998

The server must be joined to a Windows Active Directory domain with GSSAPI authentication explicitly enabled via GSSAPIAuthentication yes in sshd_config, and GSSAPIStrictAcceptorCheck must be configured (its presence is what triggers the bypassed code path). Exploitation requires the attacker to already possess valid Kerberos credentials within the Active Directory domain - this is not an unauthenticated attack despite PR:N in the CVSS vector (which reflects no prior privilege on the target SSH server itself). Systems using only public key or password authentication, systems not enrolled in Active Directory, and systems where GSSAPI is disabled are entirely outside the attack surface. The CVSS AC:H rating reflects that the combined prerequisite of AD enrollment, explicit GSSAPI configuration, and possession of domain Kerberos credentials significantly limits realistic exploitation.

The CVSS 4.8 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N represents moderate, bounded risk. The AC:H rating is the critical moderating factor: exploitation requires the SSH server to be actively enrolled in a Windows Active Directory domain, GSSAPI authentication to be explicitly enabled, and the attacker to hold valid Kerberos credentials within that domain. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists for this CVE, and no public proof-of-concept has been identified, making this a low-exploitation-pressure issue at time of analysis. The C:L and I:L impact ratings reflect that this is a security control bypass rather than a direct remote code execution or credential theft primitive - successful abuse lets an attacker authenticate with an unintended service principal, not gain arbitrary system access. Organizations that have not explicitly enabled GSSAPI/Kerberos authentication or are not AD-joined are entirely unaffected. Real-world priority is moderate for AD-integrated environments where administrators have explicitly relied on GSSAPIStrictAcceptorCheck as a hardening control.

An attacker holding valid Kerberos credentials for a different service principal within the Active Directory domain connects to an AD-joined SSH server with GSSAPIAuthentication enabled and GSSAPIStrictAcceptorCheck set. Because the strict acceptor check is silently ignored in the AD environment, the server accepts the GSSAPI authentication without verifying the service principal name matches the intended SSH host principal, granting the attacker an SSH session that should have been rejected. No public proof-of-concept exists at time of analysis, and the attacker must already possess valid domain Kerberos credentials, limiting the practical threat to insider or partially-compromised-domain scenarios.