Red Hat issued a security advisory (RHSA-2026:37382) for Red Hat Hardened Images RPMs, including OpenSSH version 10.4p1-1.hum1 for aarch64 and x86_64. The advisory addresses multiple CVEs (CVE-2026-59995 through CVE-2026-60002) affecting OpenSSH components. A key vulnerability (CVE-2026-59996) involves a flaw in the scp command where files copied between two remote systems may be incorrectly placed in the parent directory of the intended destination, potentially exposing sensitive data or causing data integrity issues. Exploitation requires explicit user action to perform remote-to-remote scp transfers. The vulnerability does not allow arbitrary code execution, denial of service, or privilege escalation. Red Hat recommends avoiding direct remote-to-remote scp operations and using sftp or rsync instead. The advisory lists updated RPM packages but does not explicitly state that these updates fix the vulnerabilities, so patch status should be confirmed via the vendor advisory links. No known active exploits have been reported.

The impact is limited to unintended file placement during scp operations between two remote hosts, which may lead to data integrity issues or unauthorized access if files are stored in an exposed parent directory. There is no direct impact on code execution, denial of service, or privilege escalation. The vulnerability requires specific user actions to trigger and depends on existing directory permissions for any data exposure. No known exploits are reported in the wild.

Red Hat advises users to avoid performing scp operations directly between two remote systems. Instead, users should copy files first to a local machine and then to the second remote host. Alternatively, use sftp or rsync for remote file transfers, as these tools are not affected by this vulnerability. Users should consult the Red Hat advisory and update to the provided OpenSSH RPM versions if available. Patch status is not explicitly confirmed; verify current remediation guidance from Red Hat's official advisory.