CVE-2026-15370Disclosure(libssh / enterprise_linux)

MEDIUMCVSS 7.3 · HIGH

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch libssh enterprise_linux systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.

libssh CVEs Back to dashboard

5.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-121

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

enterprise_linux
enterprise_linux_for_els
enterprise_linux_for_eus
enterprise_linux_for_ibm_z_systems

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 3 classified signals
Peaked 1d ago at 3 mentions (2026-07-21); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

libssh redhat

Products

enterprise_linuxenterprise_linux_for_elsenterprise_linux_for_eusenterprise_linux_for_ibm_z_systemsenterprise_linux_for_ibm_z_systems_elsenterprise_linux_for_ibm_z_systems_eusenterprise_linux_for_power_little_endianenterprise_linux_for_power_little_endian_elsenterprise_linux_for_power_little_endian_eushardened_images

4 versions affected across 11 products

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

Active Exploitation

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-21	3	Active Exploitation1Disclosure2
2026-07-22	1	Disclosure1

Full discourse4 posts

Open Source Security mailing list@oss_security90d
Disclosure
libssh 0.12.1, 0.11.5 security releases https://www.openwall.com/lists/oss-security/2026/07/21/7 Announcement lists 11 CVEs with titles starting with "CVE-2026-15370: Stack buffer overflow in SFTP server longname construction" and 1 non-CVE security change
Post summary
The libssh team announced new security releases (0.12.1 and 0.11.5) that address 11 CVEs, including a stack buffer overflow (CVE-2026-15370) in the SFTP longname constructor, thereby patching the vulnerabilities.
02030643
4.7K followersView on X
VulDB 🛡@vuldb91d
Active Exploitation
A lot of offensive activities were identified targeting Red Hat Enterprise Linux (CVE-2026-15370) https://vuldb.com/vuln/380831/cti
Post summary
The post reports that numerous offensive activities targeting Red Hat Enterprise Linux via CVE‑2026‑15370 are occurring, but it provides no PoC, exploit code, patch, or detailed technical info.
00000108
2.3K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-15370 Stack Buffer Overflow in libssh SFTP Server Directory Listing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15370
Post summary
The entry identifies CVE-2026-15370 as a stack buffer overflow vulnerability in libssh’s SFTP server directory listing, directing readers to a detailed vulnerability page.
00000123
4.1K followersView on X
VulDB 🛡@vuldb91d
Disclosure
There is a new vulnerability with elevated criticality in Red Hat Enterprise Linux (CVE-2026-15370) https://vuldb.com/vuln/380831
Post summary
A new critical vulnerability (CVE-2026-15370) for Red Hat Enterprise Linux has been announced, with a reference to a vulnerability database page.
00000108
2.3K followersView on X

CPE platform detail20 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

20 of 20 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	libssh	libssh	-	-	-
App	libssh	libssh	0.12.0	-	-
OS	redhat	enterprise_linux	10.0	-	-
OS	redhat	enterprise_linux	10.0	-	arm64
OS	redhat	enterprise_linux	10.0	-	x64
OS	redhat	enterprise_linux	10.2	-	arm64
OS	redhat	enterprise_linux	10.2	-	x64
OS	redhat	enterprise_linux_for_els	10.2	-	arm64
OS	redhat	enterprise_linux_for_els	10.2	-	x64
OS	redhat	enterprise_linux_for_eus	10.2	-	arm64
OS	redhat	enterprise_linux_for_eus	10.2	-	x64
OS	redhat	enterprise_linux_for_ibm_z_systems	10.0	-	-
OS	redhat	enterprise_linux_for_ibm_z_systems	10.2	-	-
OS	redhat	enterprise_linux_for_ibm_z_systems_els	10.2	-	-
OS	redhat	enterprise_linux_for_ibm_z_systems_eus	10.2	-	-
OS	redhat	enterprise_linux_for_power_little_endian	10.0	-	-
OS	redhat	enterprise_linux_for_power_little_endian	10.2	-	-
OS	redhat	enterprise_linux_for_power_little_endian_els	10.2	-	-
OS	redhat	enterprise_linux_for_power_little_endian_eus	10.2	-	-
App	redhat	hardened_images	-	-	-

Explore more

Back to dashboard libssh CVEs redhat CVEs enterprise_linux vulnerabilities

What researchers are saying

CVE-2026-15370

Open Source Security mailing list@oss_securityDisclosure

The libssh team announced new security releases (0.12.1 and 0.11.5) that address 11 CVEs, including a stack buffer overflow (CVE-2026-15370) in the SFTP longname constructor, thereby patching the vulnerabilities.

VulDB 🛡@vuldbActive Exploitation

The post reports that numerous offensive activities targeting Red Hat Enterprise Linux via CVE‑2026‑15370 are occurring, but it provides no PoC, exploit code, patch, or detailed technical info.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The entry identifies CVE-2026-15370 as a stack buffer overflow vulnerability in libssh’s SFTP server directory listing, directing readers to a detailed vulnerability page.

VulDB 🛡@vuldbDisclosure

A new critical vulnerability (CVE-2026-15370) for Red Hat Enterprise Linux has been announced, with a reference to a vulnerability database page.