CVE-2026-35385: OpenSSH scp Legacy Protocol Setuid File Installation

HERMES

HERMES THREAT SCORE & SYSTEM ATTACK SURFACE

Target: OpenSSH (scp.c)

Confidence: 94%

82 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-35385 at 7.5 (HIGH, CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The Hermes Threat Score evaluates operational impact at 82 (HIGH) reflecting enterprise infrastructure exposure.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-35385: OpenSSH scp Legacy Protocol Setuid File InstallationVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTOpenSSH Suite

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in OpenSSH Suite documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Security Advisory: CWE-276: Incorrect Default Permissions

CVSS v3.1 : 7.5 HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) / CWE-276: Incorrect Default Permissions. Addressed in official upstream release 10.3p1.

Executive Summary

CVE-2026-35385 impacts OpenSSH releases prior to 10.3. When an administrator or automation script executes scp -O (forcing legacy SCP protocol instead of modern SFTP) as user root without passing the -p (preserve permissions) option, the SCP client applies mode masks that preserve setuid and setgid permission bits (04000 / 02000) sent by the remote server. A compromised or hostile SSH server can deliver weaponized binaries that become instantly root-setuid on the client machine, establishing a persistent local root backdoor.

---

1. Technical Context & Affected Software Matrix

The vulnerable software component OpenSSH (scp.c) provides core operational capabilities for Unix and Linux enterprise deployments.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-35385	Official Upstream Security Release
Affected Product	openssh:openssh	Core Infrastructure Component
Vulnerable Component	OpenSSH (scp.c)	System Library / Daemon / Emulator
Weakness Class	CWE-276: Incorrect Default Permissions	Security Control / Memory Safety Flaw
CVSS v3.1 Score	7.5 (HIGH / Hermes Score 82)	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Fixed Version	10.3p1	Upstream patch release
MITRE ATT&CK	T1548.001 - Setuid and Setgid, T1068 - Exploitation for Privilege Escalation	Privilege Escalation / Defense Evasion
Forensic Cross-Reference	Linux File Integrity and Setuid Permission Forensics	Artifact analysis and trace investigation

---

2. In-Depth Technical Decomposition & Root Cause

Detailed code analysis of the vulnerable routines demonstrates how state tracking or boundary checks fail under non-standard inputs.

// Vulnerability in scp.c (sink function)
void sink(int argc, char **argv, const char *src)
{
    mode_t mode;
    /* Parsing incoming mode from remote server: e.g. "C4755 1024 binary" */
    mode = strtol(cp, NULL, 8);

    if (!pflag) {
        /* VULNERABILITY: Omits stripping S_ISUID and S_ISGID bits when run as root! */
        mode &= 07777; // Retains 04000 (setuid) and 02000 (setgid)
        mode &= ~mask;
    }
    chmod(np, mode); // Sets root-owned setuid on local filesystem!
}

Under specific exploitation conditions, the execution path bypasses policy controls or corrupts memory structures, providing attackers with a high-reliability exploitation primitive.

---

3. Attack Scenarios & Threat Modeling

1. Initial Vector & Preconditions: An administrator downloads logs or backup scripts from a compromised server using sudo scp -O server:/opt/backup /usr/local/bin/.
2. Triggering Primitive: The attacker executes crafted parameters or issues unexpected network requests targeting OpenSSH (scp.c).
3. Control Bypass / Memory Violation: Parsing incoming mode from remote server: e.g. “C4755 1024 binary”.
4. Impact Realization: The client writes the file owned by root with setuid enabled, allowing any unprivileged local user on the administrative workstation to execute it and obtain instant root privileges..

---

4. Forensic Detection, Artifacts & System Logs

Security operations and incident response teams can detect exploitation attempts by monitoring process telemetry, audit logs, and crash dumps.

System Logs & Telemetry

Monitor system logs for indicators matching: audit: type=1300 ... syscall=chmod mode=0104755 by scp. Look for unexpected aborts or anomalous system call patterns.

Auditd & Process Tracing

Deploy targeted audit rules to trace suspicious command sequences. Consult Linux File Integrity and Setuid Permission Forensics.

Threat Hunting Rule (Sigma / Auditd)

Sigma Rule

sigma_cve_2026_35385.yaml

title: Creation of Setuid Executable via Legacy OpenSSH scp Client
id: cve-2026-35385
status: experimental
description: Detects exploitation artifacts and crash signatures for CVE-2026-35385.
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        - 'audit:'
        - 'openssh'
    condition: selection
fields:
    - CommandLine
    - User
level: high

eBPF Tracepoint

# Monitor invocations associated with openssh:openssh
sudo bpftrace -e '
kprobe:scp.c {
    printf("PID %d (%s) invoked target function\n", pid, comm);
}'

---

5. Remediation & Hardening Guidelines

Protecting infrastructure against CVE-2026-35385 requires applying vendor security updates and enforcing least-privilege configurations:

1. Software Update: Upgrade openssh:openssh packages to version 10.3p1 or higher via your operating system package manager.
2. Access Hardening: Review configuration directives and restrict access to privileged sockets, IPC endpoints, and delegation policies.
3. Forensic Preparedness: Refer to our dedicated guide on Linux File Integrity and Setuid Permission Forensics for forensic procedures and logging best practices.