CVE-2026-85756Patch

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an application passes an attacker-controlled path to a shell-based server, shell metacharacters not neutralized by the active IRemotePathTransformation can execute commands as the authenticated SSH user. Exploitation requires a shell-based server and a path crafted for that shell's parsing rules; non-shell servers and paths fully neutralized by the selected transformation are not affected. RemotePathTransformation.ShellQuote is available for POSIX shells, while SftpClient avoids a remote shell entirely. This issue is fixed in version 2026.0.0.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://github.com/sshnet/SSH.NET/security/advisories/GHSA-mggc-4xg6-vcxf

Full discourse1 post

Rıdvan Yağlı@ridvanyagli46d
Patch
🔴 SSH[.]NET'de CVSS 7.5 seviyede önemli RCE açığı! SSH[.]NET'in ScpClient bileşeninde, saldırgan kontrollü SCP remote path'lerinin yetersiz şekilde escape edilmesi nedeniyle sunucu tarafında komut çalıştırılmasına yol açabilecek bir güvenlik açığı (CVE-2026-85756) tespit edildi. Açık, shell-based SSH sunucularında ve saldırganın remote path'i etkileyebildiği senaryolarda, komutların kimliği doğrulanmış SSH kullanıcısının yetkileriyle çalıştırılmasına neden olabiliyor. Etkilenen sürümler: SSH[.]NET ≤ 2025.1.0 ✅ Düzeltilen sürüm: 2026.0.0 POSIX shell'ler için RemotePathTransformation.ShellQuote kullanılabilir. Mümkünse SCP yerine SFTP (SftpClient) kullanılması öneriliyor. Advisory: https://github.com/sshnet/SSH.NET/security/advisories/GHSA-mggc-4xg6-vcxf
Post summary
The text announces CVE-2026-85756, a CVSS 7.5 RCE vulnerability in SSH.NET's ScpClient component, and primarily focuses on remediation by naming the fixed version (2026.0.0) and suggesting workarounds such as using SFTP and ShellQuote.
00001232
2.4K followersView on X

Explore more

Back to dashboard