CVE-2026-83923

Summary

OpenSSH for Windows contains a relative path traversal vulnerability (CWE-23) that allows unauthenticated attackers to execute arbitrary code remotely. This flaw occurs when the server processes file paths with relative references, potentially enabling attackers to access and execute files outside the intended directory structure.

Exploitability

Exploitation requires an attacker to send a specially crafted request to the OpenSSH service over the network, which is relatively straightforward given that the vulnerability affects the core SSH service and doesn't require authentication.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on affected Windows systems with the privileges of the SSH service account, potentially leading to full system compromise or lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenSSH for Windows version 9.8p1 or later, which contains the fix for this relative path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.