OpenSSH EUVD-2026-42139

Exploitation requires that sshd is configured to use internal-sftp via the Subsystem directive AND that more than nine arguments are supplied to it in sshd_config, with a security-relevant flag such as -R (read-only), -d (directory restriction), -u (umask), or -P (permission control) placed at position 10 or later. The attacker must additionally authenticate to the server as an SFTP-capable user - unauthenticated exploitation is not possible because SFTP inherently requires a valid credential exchange. Environments using nine or fewer internal-sftp arguments, those using an external sftp-server binary rather than internal-sftp, or those that enforce access policy exclusively through other mechanisms (chroot, filesystem ACLs, PAM) are not affected. The non-default nature of a ten-plus argument configuration materially limits the exposed population.

The NVD-assigned CVSS 3.1 score is 4.2 Medium with vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. The AC:H rating accurately reflects that exploitation is contingent on a specific non-default configuration in sshd_config - more than nine arguments must be supplied to internal-sftp with a security-critical flag at position 10 or later. The PR:N rating is debatable: SFTP inherently requires user authentication, which suggests PR:L is more appropriate; the official PR:N may reflect that the attacker holds no elevated privilege on the server beyond a standard user account. The UI:R designation in the official vector is not clearly justified by the available description or references and may represent scoring uncertainty. No EPSS data was provided. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept exploit code has been identified, making real-world exploitation probability low in the absence of targeted actor interest. Practical risk is meaningful only for organizations that specifically use 10-plus argument internal-sftp configurations for SFTP policy enforcement; the overwhelming majority of OpenSSH deployments using zero to nine arguments are unaffected.

An attacker holding valid SFTP credentials on a server where sshd_config specifies the read-only flag (-R) or a directory restriction (-d) as the tenth or later argument to internal-sftp connects via any standard SFTP client. Because internal-sftp silently ignores that argument, the intended restriction is never applied, and the attacker gains write access or directory traversal capability the administrator believed was blocked. No proof-of-concept exploit code is publicly known at time of analysis.