CVE-2026-59997 describes an improper validation issue (CWE-1284) in the internal-sftp subsystem of OpenSSH versions before 10.4. Specifically, sshd's internal-sftp recognizes only the first nine command-line arguments, potentially ignoring subsequent arguments that could be critical for ensuring the intended security properties of an SFTP connection. This could lead to a scenario where security controls expected to be enforced via later arguments are not applied.

The vulnerability has a CVSS 3.1 base score of 4.2 (medium severity), indicating limited impact. It affects confidentiality and integrity with low impact and requires network attack vector with high attack complexity and user interaction. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor OpenBSD and OpenSSH advisories for updates addressing this issue. Until a patch is available, carefully review and limit the use of command-line arguments in internal-sftp configurations to avoid reliance on arguments beyond the ninth position.