In OpenSSH before 10

CVE-2026-35385 affects OpenSSH before 10.3/10.3p1. When scp downloads a file as root, while forcing legacy SCP mode with -O, and without -p, the client may leave setuid or setgid bits on the downloaded file instead of clearing them. The result is not remote code execution in sshd; it is a dangerous permission outcome on the *client host* after a privileged file pull from an attacker-controlled or compromised source.

The vendor's 7.5/HIGH score overstates real enterprise risk. OpenSSH switched scp to SFTP by default years earlier, so the exposed population is already narrowed to workflows that explicitly opt back into legacy mode with -O; then you still need a root-run transfer, a malicious source endpoint, and a file that later gets executed. That is real risk for brittle admin automation, but it is nowhere near the operational urgency of an unauthenticated server-side SSH bug.

Why this verdict

• -2.0 for attacker position: the attacker needs control of the remote file source or a prior compromise in that trust path; this is not unauthenticated reach to your exposed sshd fleet.
• -1.5 for explicit legacy opt-in: OpenSSH moved scp to SFTP by default, so the vulnerable path only exists when operators or scripts deliberately force legacy SCP with -O.
• -0.9 for privileged workflow rarity: the transfer must run as root and omit -p; that is a narrow admin/automation pattern, not a default end-user behavior.

Why not higher?

It is not wormable, not internet-reachable in the usual SSH sense, and not useful without a malicious or compromised source endpoint plus a root-run download. There is also no KEV listing, no reviewed evidence of active exploitation, and very low EPSS pressure.

Why not lower?

If you do have brittle root-run automation using scp -O, this can silently plant SUID/SGID artifacts that become local privilege escalation or persistence later. The impact on an affected host is real; the problem is the population exposed, not the harmlessness of a successful exploit.

1. Find scp -O in automation — Search shell scripts, CI jobs, cron, Ansible, Salt, Puppet, backup tooling, and network-device collection workflows for explicit scp -O use, especially under root. For a LOW finding there is no SLA here beyond backlog hygiene, but this is the single best control because it identifies the tiny slice of your estate that is actually reachable.
2. Stop pulling files as root — Move transfers to an unprivileged service account, then copy into final locations with controlled ownership and mode-setting (install, chmod, chown) after validation. For LOW, do this in the next normal engineering cycle; it removes the biggest amplifier in the chain.
3. Retire legacy SCP mode — Prefer default scp behavior over SFTP, plain sftp, or rsync -e ssh, and remove compatibility flags that force -O unless there is a documented exception. Treat this as backlog hygiene for LOW severity, but use it to permanently collapse exposure.
4. Harden download destinations — Use nosuid on staging/download filesystems where possible, and monitor for newly created SUID/SGID files after admin transfer jobs. For LOW, implement as part of routine platform hardening; this reduces impact even if a bad transfer still happens.

Run this on the target Linux/macOS host that has the OpenSSH client installed. Invoke it as sudo bash ./check-cve-2026-35385.sh so it can inspect common automation paths such as /etc, /opt, /usr/local, and cron; without root it may return UNKNOWN more often.

#!/usr/bin/env bash
# check-cve-2026-35385.sh
# Detect likely exposure to CVE-2026-35385 on hosts with OpenSSH client.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN
#   3 = ERROR

set -u

have_cmd() { command -v "$1" >/dev/null 2>&1; }

version_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

extract_openssh_version() {
  local out ver
  if have_cmd ssh; then
    out="$(ssh -V 2>&1)"
  elif have_cmd scp; then
    out="$(scp -V 2>&1 || true)"
  else
    return 1
  fi

  ver="$(printf '%s' "$out" | sed -n 's/.*OpenSSH[_ ]\([0-9][0-9.]*p\{0,1\}[0-9]*\).*/\1/p' | head -n1)"
  [ -n "$ver" ] || return 1
  # Normalize portable suffix, e.g. 10.2p1 -> 10.2.1 for sort -V
  ver="$(printf '%s' "$ver" | sed 's/p/./')"
  printf '%s\n' "$ver"
  return 0
}

scan_for_legacy_root_scp() {
  local hits=0 paths=()
  local p
  for p in /etc /usr/local /opt /root /var/spool/cron /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly; do
    [ -e "$p" ] && paths+=("$p")
  done

  if [ ${#paths[@]} -eq 0 ]; then
    return 2
  fi

  # Look for explicit -O use near scp invocation.
  if grep -RIlE --exclude-dir='.git' --exclude='*.pyc' '(^|[^A-Za-z0-9_])scp([[:space:]].*)?[[:space:]]-O([[:space:]]|$)|(^|[^A-Za-z0-9_])scp[[:space:]].*-O([[:space:]]|$)' "${paths[@]}" >/tmp/cve2026_35385_hits.$$ 2>/dev/null; then
    hits=$(wc -l < /tmp/cve2026_35385_hits.$$)
    rm -f /tmp/cve2026_35385_hits.$$
    [ "$hits" -gt 0 ] && return 0
  fi

  rm -f /tmp/cve2026_35385_hits.$$ 2>/dev/null || true
  return 1
}

main() {
  local ver fixed="10.3"

  if ! have_cmd ssh && ! have_cmd scp; then
    echo "UNKNOWN"
    exit 2
  fi

  if ! ver="$(extract_openssh_version)"; then
    echo "UNKNOWN"
    exit 2
  fi

  if ! version_lt "$ver" "$fixed"; then
    echo "PATCHED"
    exit 0
  fi

  # Version is in affected range. Now look for real workflow exposure.
  scan_for_legacy_root_scp
  case $? in
    0)
      echo "VULNERABLE"
      exit 1
      ;;
    1)
      echo "UNKNOWN"
      exit 2
      ;;
    *)
      echo "UNKNOWN"
      exit 2
      ;;
  esac
}

main

Sources

1. OpenSSH release notes
2. OpenSSH 10.3 release announcement on oss-security
3. NVD entry for CVE-2026-35385
4. Ubuntu security tracker for CVE-2026-35385
5. Debian security tracker for CVE-2026-35385
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API documentation