CVE-2026-59997

CVE-2026-59997 describes a vulnerability within the `internal-sftp` component of `sshd` in OpenSSH versions prior to 10.4. The core issue stems from the fact that `internal-sftp` only processes the first nine command-line arguments. This limitation can be significant if later command-line arguments are intended to enforce specific security properties for an SFTP connection. An unauthenticated attacker could potentially bypass these intended security measures by providing arguments beyond the ninth position, thereby altering the expected security behavior of the SFTP connection. While exploitation can occur remotely over a network without requiring privileges, successful exploitation does necessitate user interaction.