CVE-2026-59847 is a vulnerability in libssh where incorrect AES-GCM finalization checks in builds using the OpenSSL backend effectively remove integrity protection. This flaw enables an attacker positioned in the communication path to alter plaintext data without detection. The vulnerability is classified under CWE-1310 and has a CVSS 3.1 vector indicating network attack complexity is high, no privileges or user interaction required, and impacts integrity but not confidentiality or availability. Red Hat has issued a security advisory with updated libssh packages to remediate this issue.

The vulnerability allows an attacker with network access to modify plaintext data transmitted over libssh connections without detection, compromising data integrity. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits in the wild have been reported at this time.

Red Hat has released updated libssh packages (libssh-0.12.1-4.hum1) as part of their Hardened Images RPMs to fix this vulnerability. Users of affected Red Hat Hardened Images should apply these updates promptly. Patch status is confirmed by the vendor advisory. No additional mitigation steps are specified or required beyond applying the official update.