Linux · Security advisory · November 7, 2026

ELSA-2026-88211: Security update for 8 packages

ELSA-2026-88211, released November 7, 2026, fixes 5 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0062
49th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 2 Routine 3

Fixed package versions

ProductReleaseFixed in
opensshol 80:8.0p1-34.0.1.el8_10
openssh-askpassol 80:8.0p1-34.0.1.el8_10
openssh-cavsol 80:8.0p1-34.0.1.el8_10
openssh-clientsol 80:8.0p1-34.0.1.el8_10
openssh-keycatol 80:8.0p1-34.0.1.el8_10
openssh-ldapol 80:8.0p1-34.0.1.el8_10
openssh-serverol 80:8.0p1-34.0.1.el8_10
pam_ssh_agent_authol 80:0.10.3-8.34.0.1.el8_10

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-60000 sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication. 7.5 0.0062 None reported
High CVE-2026-73283 In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. 7.5 0.0015 None reported
Routine CVE-2026-60001 sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. 6.5 0.0029 None reported
Routine CVE-2026-59998 sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory. 6.5 0.0018 None reported
Routine CVE-2026-59997 internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection. 6.5 0.0018 None reported
Showing 1 to 5 of 5 1