CVE-2026-85756

SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an application passes an attacker-controlled path to a shell-based server, shell metacharacters not neutralized by the active IRemotePathTransformation can execute commands as the authenticated SSH user. Exploitation requires a shell-based server and a path crafted for that shell's parsing rules; non-shell servers and paths fully neutralized by the selected transformation are not affected. RemotePathTransformation.ShellQuote is available for POSIX shells, while SftpClient avoids a remote shell entirely. This issue is fixed in version 2026.0.0.

• CWE-78

• https://github.com/sshnet/SSH.NET/commit/c66b9f8fb06c12e71761e58a577b1e796026310f
• https://github.com/sshnet/SSH.NET/releases/tag/2026.0.0
• https://github.com/sshnet/SSH.NET/security/advisories/GHSA-mggc-4xg6-vcxf

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85738TREK is a collaborative travel planner. Prior to 3.4.0, the …6.3
• CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to …8.3
• CVE-2026-85740LightRAG provides simple and fast retrieval-augmented genera…7.1
• CVE-2026-8575Use after free in UI in Google Chrome prior to 148.0.7778.16…8.3
• CVE-2026-85750Piwigo before v16.4.0 is vulnerable to arbitrary file read a…7.2
• CVE-2026-85751Mailu is a mail server distributed as a set of Docker images…9.8
• CVE-2026-8576Inappropriate implementation in CORS in Google Chrome on Lin…4.3
• CVE-2026-85769A flaw was found in libtpms, a library that provides softwar…6.5
• CVE-2026-8577Integer overflow in Fonts in Google Chrome prior to 148.0.77…8.8
• CVE-2026-8578Out of bounds read in GPU in Google Chrome on Linux prior to…3.1
• CVE-2026-85781Unverified ownership of a storage access point in the volume…8.7
• CVE-2026-85786Improper handling of highly compressed data in Amazon ion-ja…7.5