Critical OpenSSH Vulnerability Allows Privilege Escalation on Ubuntu Systems

A critical vulnerability in OpenSSH has been identified, affecting Ubuntu systems, particularly version 16.04. The flaw arises from improper handling of file permissions when downloading files as root using the legacy scp protocol without the preserve-mode option. This vulnerability could allow attackers to install setuid or setgid files, leading to potential privilege escalation. The issue is documented under USN-8514-1 and has been assigned the CVE-2026 identifier. Users are advised to update their systems to mitigate the risk. Ubuntu Pro users benefit from extended security coverage for this vulnerability. A standard system update is recommended for all affected users to ensure protection against exploitation.

Key Points: • OpenSSH vulnerability allows privilege escalation via legacy scp protocol. • Affected systems include Ubuntu 16.04, with a critical advisory issued (USN-8514-1). • Immediate system updates are necessary to mitigate the risk of exploitation.