{"id":"CVE-2026-83923","published":"2026-10-13T19:20:48.297","lastModified":"2026-10-16T16:21:47.817","description":"Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-23"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83923","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"OpenSSH for Windows contains a relative path traversal vulnerability (CWE-23) that allows unauthenticated attackers to execute arbitrary code remotely. This flaw occurs when the server processes file paths with relative references, potentially enabling attackers to access and execute files outside the intended directory structure.","exploitability":"Exploitation requires an attacker to send a specially crafted request to the OpenSSH service over the network, which is relatively straightforward given that the vulnerability affects the core SSH service and doesn't require authentication.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on affected Windows systems with the privileges of the SSH service account, potentially leading to full system compromise or lateral movement within the network.","remediation":"Upgrade to OpenSSH for Windows version 9.8p1 or later, which contains the fix for this relative path traversal vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","ssh","windows","path-traversal"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:59:50.698Z"}}