Security readout for executives and security teams
Plain-English summary
A malicious or compromised SCP server can make a libssh-based client save files outside its intended download directory. This could overwrite local files or plant executable and configuration files. Harm still depends on a user connecting to that server and, in some scenarios, later executing or relying on the planted file.
Executive priority
Treat this as a targeted, moderate-priority remediation. Prioritize workstations, automation, and administrative systems that retrieve files through libssh-based SCP from external or partner-controlled servers. Accelerate response where overwritten configuration or executable files could affect privileged processes. There is no supplied evidence of active exploitation.
Technical view
CVE-2026-0964 is a CWE-22 path-sanitization flaw in libssh SCP client handling. Server-supplied paths may escape the working directory and overwrite local files. The CVSS 3.0 score is 5.0, with high attack complexity and required user interaction. The issue parallels OpenSSH CVE-2019-6111.
Likely exposure
Exposure centers on applications using affected libssh packages as SCP clients, particularly listed RHEL 8, 9, and 10 systems and OpenShift 4 components. Risk requires an SCP connection to a malicious or compromised server. The bundle marks specified libssh2 products unaffected; exact application dependency and package-build verification remain necessary.
Exploitation context
The bundle does not report active exploitation, and this CVE is not listed as KEV. Exploitation requires influencing a victim to retrieve files from a hostile SCP server. Successful path traversal may alter confidentiality, integrity, and availability locally, but follow-on consequences depend on file placement, permissions, and subsequent user or application behavior.
Researcher notes
The core primitive is client-side path traversal controlled by an SCP server. The bundle equates it with OpenSSH CVE-2019-6111, but no exploit details should be inferred. RHEL 8/9/10 and named OpenShift 4 components are marked affected; listed libssh2 products are unaffected. The duplicated RHEL 9 entry does not establish additional scope.
Mitigation direction
- Apply the applicable Red Hat errata or vendor-supported libssh security update.
- Use upstream libssh security releases where appropriate and supported by the application vendor.
- Restrict SCP downloads to trusted, authenticated servers until remediation is complete.
- Avoid relying solely on the destination directory to contain files from untrusted SCP servers.
Validation and detection
- Inventory installed libssh and libssh2 package versions across RHEL and OpenShift assets.
- Identify applications that use libssh SCP client functionality, including indirect dependencies.
- Compare exact package builds against the applicable Red Hat advisories and upstream release guidance.
- Confirm systems labeled unaffected actually use libssh2 products identified as unaffected in the bundle.
- Review recent SCP activity involving untrusted servers and investigate unexpected local file changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0964 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L1.63.4redhatVulnerability scoring details
Base CVSS 3.0 score
5MediumVector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:18160CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:18683CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-0964CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2436979CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/CVE reference, redhat
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.